Description
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
Published: 2026-10-22
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Wasmtime versions 47.0.0 through 48.0.3 and 49.0.0 through 49.0.1 contain a fuel accounting flaw in Cranelift‑compiled call_ref and try_table catch paths. A malicious guest can reset consumed fuel after calls, allowing it to run exponentially long on linear fuel, bypassing normal timeouts and periodic yields. This results in a denial of service by exhausting the host's resources. The weakness is an uncontrolled resource consumption flaw, identified as CWE‑400, and a resource exhaustion flaw, CWE‑770.

Affected Systems

Bytecodealliance Wasmtime in versions 47.0.0 through 48.0.3 and 49.0.0 through 49.0.1.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity, but the lack of an EPSS score means the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The likely attack vector requires a malicious WebAssembly guest that can call the compromised paths; thus it is primarily a guest‑side exploit. If no mitigation is applied, the host can be brought to a denial of service state by persistent execution of crafted guest code.

Generated by OpenCVE AI on October 23, 2026 at 03:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Wasmtime to version 48.0.3 or later, or 49.0.1 or later, to eliminate the fuel accounting flaw.
  • If an upgrade is not immediately possible, restrict or disable execution of Cranelift‑compiled call_ref and try_table catch paths for untrusted guests.
  • Implement an external watchdog timer or enforce stricter host‑side yield policies to prevent long‑running guest execution.

Generated by OpenCVE AI on October 23, 2026 at 03:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
Title Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
First Time appeared Bytecodealliance
Bytecodealliance wasmtime
Weaknesses CWE-400
CWE-770
CPEs cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
Vendors & Products Bytecodealliance
Bytecodealliance wasmtime
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

threat_severity

Moderate

Subscriptions

Bytecodealliance Wasmtime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T19:13:55.910Z

Reserved: 2026-10-22T11:27:18.001Z

Link: CVE-2026-115390

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-22T19:17:46.510

Modified: 2026-10-22T19:17:46.647

Link: CVE-2026-115390

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-22T19:13:55Z

Links: CVE-2026-115390 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T04:00:11Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling