Read the docs
TI-2026-22231 Aliases CVE-2026-27887

Spin has memory leaks in various WIT interfaces

Priority LOW 30CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin is configured to allow connections to a database or web server which could return responses of unbounded size (e.g. tables with many rows or large content bodies), Spin may in some cases attempt to buffer the entire response before delivering it to the guest, which can lead to the host process running out of memory, panicking, and crashing. In addition, a malicious guest application could incrementally insert a large number of rows or values into a database and then retrieve them all in a single query, leading to large host allocations. Spin 3.6.1, SpinKube 0.6.2, and `containerd-shim-spin` 0.22.1 have been patched to address the issue. As a workaround, configure Spin to only allow access to trusted databases and HTTP servers which limit response sizes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Fix Fixed spin (spinframework): 3.6.1SpinKube (spinframework): 0.6.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
spinframeworkspinbefore 3.6.13.6.1Patch availableCNA
spinframeworkSpinKubebefore 0.6.20.6.2Patch availableCNA
spinframeworkcontainerd-shim-spinbefore 0.22.10.22.1Patch availableCNA
  • spin Vendorspinframework Affected before 3.6.1 Fixed in 3.6.1 Patch available CNA
  • SpinKube Vendorspinframework Affected before 0.6.2 Fixed in 0.6.2 Patch available CNA
  • containerd-shim-spin Vendorspinframework Affected before 0.22.1 Fixed in 0.22.1 Patch available CNA

Remediation

  • Fix · CNA spin (spinframework) Fixed in 3.6.1
  • Fix · CNA SpinKube (spinframework) Fixed in 0.6.2
  • Fix · CNA containerd-shim-spin (spinframework) Fixed in 0.22.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27887

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences