CVE-2026-115390: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled callref and trytable catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 26.0.1+dfsg-3Fixed in 36.0.13+dfsg-1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments that execute malicious or otherwise untrusted Wasmtime guests are most exposed. A malicious guest can use the affected Cranelift-compiled call_ref and try_table catch paths to bypass intended fuel-based execution limits.
What does an attacker need to do to trigger the denial of service?
The attacker needs the ability to run a malicious guest in the affected Wasmtime environment. The guest must exercise the affected call_ref or try_table catch paths to reset consumed fuel after calls.
Which releases should be used to remediate the issue?
Upgrade affected 47.0.0 releases to 48.0.3 or later, or upgrade affected 49.0.0 releases to 49.0.1 or later. Versions before those fixed releases in the stated branches are affected.
How can teams identify potentially vulnerable instances?
Inventory Wasmtime versions and identify instances running 47.0.0 before 48.0.3 or 49.0.0 before 49.0.1. Prioritize instances that execute untrusted guests or rely on fuel limits, timeouts, or periodic yields to constrain guest execution.