Technical impact
Wasmtime, a WebAssembly runtime, contains a flaw in the handling of the wasi:http/types.fields resource that triggers a panic when a client provides an excessive number of HTTP header fields. The panic causes the Wasmtime process to terminate abruptly, effectively denying service to any request or application using the runtime. This failure mode is a classic example of CWE‑770 – Excessive Resource Consumption, where unbounded input leads to resource exhaustion and a crash.
Affected Systems
The issue affects the BytecodeAlliance Wasmtime product in all releases older than 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0. Any embedding or deployment of Wasmtime that has not been updated to at least one of the patched releases is susceptible.
Risk and Exploitability
With a CVSS score of 6.9 and an EPSS estimate of less than 1 %, the vulnerability is considered moderate in severity and likely has low to moderate exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an attacker can craft HTTP requests with an overlarge number of header fields to trigger the panic in a Wasmtime‐based service. Once exploited, the host process or application crashes, resulting in a denial of service for legitimate users.
Github GHSA