Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.
Published: 2026-10-29
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Host Crash / Denial of Service
Action: Patch
AI Analysis

Impact

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls. The resulting host crash denies service to any application embedding Wasmtime.

Affected Systems

The affected product is Wasmtime from Bytecode Alliance. Versions 46.0.0 through 48.0.5 and 49.0.0 through 49.0.2 are vulnerable. Newer releases (48.0.6 and 49.0.3 onward) contain the fix.

Risk and Exploitability

The CVSS score is 5.9, indicating moderate severity. The EPSS score is not available, so the probability of exploitation is unclear. The vulnerability is listed as not in the CISA KEV catalog. Exploitation requires the host application to cancel pending async calls on a guest task that has not yet started, which is a local condition controlled by the embedding host. The crash leads to a denial of service but does not grant remote code execution or direct data exposure.

Generated by OpenCVE AI on October 29, 2026 at 17:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Wasmtime to version 48.0.6 or later, or version 49.0.3 or later, to eliminate the vulnerable code path.
  • If updating is not immediately possible, modify your host code to avoid dropping the Future returned by call_async until the guest task has started, or otherwise ensure that all pending async calls are completed before cancellation.
  • Implement defensive checks in your embedding logic to guard against premature cancellation of async calls during guest startup, thereby preventing the panic pathway.

Generated by OpenCVE AI on October 29, 2026 at 17:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.
Title Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
First Time appeared Bytecodealliance
Bytecodealliance wasmtime
Weaknesses CWE-617
CPEs cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
Vendors & Products Bytecodealliance
Bytecodealliance wasmtime
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Bytecodealliance Wasmtime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-29T20:12:57.319Z

Reserved: 2026-10-29T14:28:41.595Z

Link: CVE-2026-119142

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-29T16:18:07.817

Modified: 2026-10-29T16:18:07.923

Link: CVE-2026-119142

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T19:45:11Z

Weaknesses