Wasmtime, a WebAssembly runtime, contains a flaw in its WASI host interface implementations that allows a malicious WebAssembly module to request an excessive amount of resources from the host. The runtime fails to enforce limits on allocations such as memory or other host resources, enabling resource exhaustion. Consequently an attacker can drain host CPU, memory, or other system resources, leading to denial of service. The weakness is reflected by improper resource handling and control, reflected by CWEs 400, 770, 774, and 789.

Bytecodealliance Wasmtime versions earlier than 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 are vulnerable. The flaw is present in all builds before those releases; newer releases contain a fix but each embedder must enable the protective knobs to prevent exploitation. All versions of Wasmtime provide adjustable limits that must be configured to stop a malicious guest from exhausting resources.

The CVSS score of 6.9 indicates a moderate severity level, and the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it from the guest side by submitting specially crafted WebAssembly modules that request excessive resources. Because the runtime does not impose limits by default, an untrusted guest can drive the host toward depletion of CPU or memory, interrupting services. The primary risk is denial of service to the host and any services that rely on Wasmtime.