CVE-2026-126407: Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments that execute untrusted or malicious guest components are exposed, because the guest component can repeatedly transfer borrowed resources. The impact is host-memory exhaustion and denial of service.
What access does an attacker need?
An attacker needs the ability to provide or run a malicious guest component and exploit a component that receives a borrow of a resource it defines itself. Exploitation is network-reachable in the supplied vector, but requires low privileges, user interaction, and high attack complexity.
Are per-store handle limits sufficient to prevent this issue?
No. The affected borrowed-resource transfers allocate untracked host memory and bypass the per-store handle limit.
Which versions contain fixes?
Fixed versions are 36.0.20, 48.0.8 in the 37.0.0 through 48.0.0 release line, 49.0.5, and 50.0.1. Versions before those listed fixes are affected.