CVE-2026-115390: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS

Q: Which deployments are most exposed to this issue?

Deployments that execute malicious or otherwise untrusted Wasmtime guests are most exposed. A malicious guest can use the affected Cranelift-compiled call_ref and try_table catch paths to bypass intended fuel-based execution limits.

Q: What does an attacker need to do to trigger the denial of service?

The attacker needs the ability to run a malicious guest in the affected Wasmtime environment. The guest must exercise the affected call_ref or try_table catch paths to reset consumed fuel after calls.

Q: Which releases should be used to remediate the issue?

Upgrade affected 47.0.0 releases to 48.0.3 or later, or upgrade affected 49.0.0 releases to 49.0.1 or later. Versions before those fixed releases in the stated branches are affected.

Q: How can teams identify potentially vulnerable instances?

Inventory Wasmtime versions and identify instances running 47.0.0 before 48.0.3 or 49.0.0 before 49.0.1. Prioritize instances that execute untrusted guests or rely on fuel limits, timeouts, or periodic yields to constrain guest execution.

Published Oct 22, 2026

Updated

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled callref and trytable catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.

Affected Software

1 affected component

Bytecode Alliance Wasmtime>=47.0.0<48.0.3, >=49.0.0<49.0.1

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments that execute malicious or otherwise untrusted Wasmtime guests are most exposed. A malicious guest can use the affected Cranelift-compiled call_ref and try_table catch paths to bypass intended fuel-based execution limits.

What does an attacker need to do to trigger the denial of service?

The attacker needs the ability to run a malicious guest in the affected Wasmtime environment. The guest must exercise the affected call_ref or try_table catch paths to reset consumed fuel after calls.

Which releases should be used to remediate the issue?

Upgrade affected 47.0.0 releases to 48.0.3 or later, or upgrade affected 49.0.0 releases to 49.0.1 or later. Versions before those fixed releases in the stated branches are affected.

How can teams identify potentially vulnerable instances?

Inventory Wasmtime versions and identify instances running 47.0.0 before 48.0.3 or 49.0.0 before 49.0.1. Prioritize instances that execute untrusted guests or rely on fuel limits, timeouts, or periodic yields to constrain guest execution.

CVE-2026-115390: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Which releases should be used to remediate the issue?

How can teams identify potentially vulnerable instances?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Which releases should be used to remediate the issue?

How can teams identify potentially vulnerable instances?