Wasmtime prior to the specified versions fails to limit allocation of component-model resource handles per instance and does not apply any ResourceLimiter or StoreLimits to these allocations, allowing a malicious guest to repeatedly create new resources and spawn sub-components until the host machine’s memory is exhausted. The impact is unbounded host memory growth, which can exhaust system resources and cause a denial of service. The weakness corresponds to CWEs that involve resource exhaustion.

The vulnerability affects Wasmtime releases before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3. The affected product is the Wasmtime WebAssembly runtime from Bytecode Alliance.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely publicized exploit yet. However, any process that runs untrusted Wasm components could potentially trigger the unbounded growth, so the attack vector is likely through execution of malicious guest code. The risk increases in environments where Wasmtime is exposed to untrusted inputs or where system memory limits are not enforced externally.