Description
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
Published: 2026-10-22
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Wasmtime versions before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contain a denial of service flaw in the WASI preview 0 poll_oneoff adapter. The adapter performs O(n) host work for each subscription without consuming or checking fuel, allowing malicious guest modules to exhaust host resources. The weakness is identified as CWE-770.

Affected Systems

Bytecodealliance’s Wasmtime engine is affected. Versions prior to 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 are vulnerable; any deployment using these releases is at risk.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available. Based on the description, it is inferred that the likely attack vector involves malicious guest modules repeatedly invoking poll_oneoff, consuming host CPU cycles, bypassing fuel limits, and eventually causing a local denial of service. The vulnerability is not listed in the CISA KEV catalog and requires the ability to run guest code within Wasmtime.

Generated by OpenCVE AI on October 23, 2026 at 03:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Wasmtime to at least 36.0.17, 48.0.4, or 49.0.2 respectively, ensuring the patch is applied
  • Ensure that fuel limits are enabled and enforced in the Wasmtime runtime configuration
  • Monitor host CPU usage and the frequency of poll_oneoff calls; restrict or sandbox untrusted guest modules and add host‑level resource limits to mitigate potential abuse

Generated by OpenCVE AI on October 23, 2026 at 03:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
Title Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
First Time appeared Bytecodealliance
Bytecodealliance wasmtime
Weaknesses CWE-770
CPEs cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
Vendors & Products Bytecodealliance
Bytecodealliance wasmtime
References
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Bytecodealliance Wasmtime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T19:13:48.469Z

Reserved: 2026-10-22T11:25:27.610Z

Link: CVE-2026-115380

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-22T19:17:44.907

Modified: 2026-10-22T19:17:45.020

Link: CVE-2026-115380

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T09:30:11Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling