UBUNTU-CVE-2026-126407: Medium severity ubuntu/rust-wasmtime vulnerability
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using an affected Wasmtime version that execute untrusted or malicious guest components are exposed. The guest must be able to define a resource and repeatedly transfer borrows of that resource.
What is required to exploit the vulnerability?
An attacker needs the ability to run a malicious guest component and must be able to repeatedly transfer borrowed resources. Exploitation is network-reachable in the supplied severity vector, but has high attack complexity, requires low privileges, and requires user interaction.
What is the impact if exploitation succeeds?
A malicious component can bypass Wasmtime's per-store handle limit by causing untracked host-memory allocations. This can consume arbitrary host memory and cause a denial of service; no confidentiality or integrity impact is indicated.
Which Wasmtime versions should be remediated?
Upgrade to 36.0.20 or later on the 36.x line, 48.0.8 or later on the 37.0.0-to-48.x line, 49.0.5 or later on the 49.x line, or 50.0.1 or later on the 50.x line. The supplied data identifies versions before those releases as affected.