CVE-2026-115389

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API

State: Published
Severity: 1.0 Low
Published: Oct 22, 2026
Updated: Oct 29, 2026
Reserved: Oct 22, 2026

Description

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.

Scores

CVSS	Score	Vector	Source
4.0	1.0 Low	CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	2.3 Low	CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L	VulnCheck

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
wasmtimebytecodealliance	before 36.0.16Affected 36.0.16Not affected 37.0.0 to before 48.0.3Affected 48.0.3Not affected 49.0.0 to before 49.0.1Affected 49.0.1Not affected

References

GitHub Security Advisory (GHSA-jqpg-j7w6-42pr)vendor-advisory
VulnCheck Advisory: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.