DEBIAN-CVE-2026-119134: Medium severity debian/rust-wasmtime vulnerability
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Hosts that use the affected Wasmtime component model and execute untrusted or malicious WebAssembly guests are exposed. The guest must be able to create resources and instantiate sub-components.
What does an attacker need to do to trigger the memory growth?
A malicious guest repeatedly calls resource.new and instantiates sub-components. This bypasses the practical effect of the per-component-instance handle-table cap by creating many instances, while allocations are not charged to ResourceLimiter or StoreLimits.
Do ResourceLimiter or StoreLimits mitigate the issue in affected versions?
No. The affected behavior specifically does not charge component-model resource handle allocations to ResourceLimiter or StoreLimits, so those limits do not constrain this source of host memory growth.
Which Wasmtime versions are affected?
Affected versions are releases before 36.0.18, versions from 37.0.0 before 48.0.6, and versions from 49.0.0 before 49.0.3.