CVE-2026-27572: Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Impact
Wasmtime's implementation of the wasi:http/types.fields resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the wasmtime-wasi-http crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime.
Patches
Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking.
Workarounds
There are no known workarounds at this time, embedders are encouraged to update to a patched version of Wasmtime.
Resources
Limitations of http::HeaderMap
Other sources
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the wasi:http/types.fields resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the wasmtime-wasi-http crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27572?
CVE-2026-27572 has been classified as a medium severity vulnerability due to its potential to cause application panics.
How do I fix CVE-2026-27572?
To fix CVE-2026-27572, update your Wasmtime installation to version 41.0.4, 40.0.4, 36.0.6, or 24.0.6 depending on your current version.
What causes CVE-2026-27572 to occur?
CVE-2026-27572 occurs when excessive fields are added to a `wasi:http/types.fields` instance in Wasmtime.
Which versions of Wasmtime are affected by CVE-2026-27572?
Versions of Wasmtime affected by CVE-2026-27572 include 41.0.0 to 41.0.4, 40.0.0 to 40.0.4, 37.0.0 to 36.0.6, and below 24.0.6.
What is the impact of CVE-2026-27572?
The impact of CVE-2026-27572 is that it can lead to application crashes or panics when handling HTTP headers.