The vulnerability in Wasmtime 46.0.0 through 48.0.3 and 49.0.0 through 49.0.1 allows an attacker controlling a WebAssembly guest to send a wasi:http request with a zero between-bytes-timeout value. That value is passed directly to a Tokio API, which panics on zero timeout and terminates the Wasmtime host process, resulting in a denial‑of‑service attack.

Bytecode Alliance’s Wasmtime binaries released between version 46.0.0 and 48.0.3, and between 49.0.0 and 49.0.1, are vulnerable because their wasi:http implementation forwards the zero between‑bytes‑timeout value without validation.

The assigned CVSS score of 5.9 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is straightforward: any payload that reaches the Wasmtime host can trigger the panic, causing a local host crash. The attack does not elevate privileges or provide network access, but it can disrupt services that rely on Wasmtime.