TI-2026-79465 Aliases CVE-2026-115380 GHSA-85gj-cvfx-w74q

Resource exhaustion in Wasmtime WASI poll_oneoff ignores fuel limits

LOW 22CWE-770Published 2026-10-22 · Updated 2026-10-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Wasmtime versions before 36.0.17, from 37.0.0 before 48.0.4, and from 49.0.0 before 49.0.2 are affected. The wasmtime-wasi WASI preview 0 poll_oneoff adapter performs linear host work per subscription without consuming or checking fuel (CWE-770). A malicious guest module can force long-running host computation that ignores configured fuel limits, causing a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00118 1st percentileScored 2026-11-07

Fix Fixed wasmtime (bytecodealliance): 36.0.17, 48.0.4, 49.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bytecodealliance	wasmtime	before 36.0.17; 37.0.0 to before 48.0.4; 49.0.0 to before 49.0.2	36.0.17, 48.0.4, 49.0.2	Patch available	CNA

wasmtime Vendorbytecodealliance Affected before 36.0.17; 37.0.0 to before 48.0.4; 49.0.0 to before 49.0.2 Fixed in 36.0.17, 48.0.4, 49.0.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:bytecodealliance:wasmtime::::::::	—	—	bytecodealliance

cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Wasmtime is fixed in versions 36.0.17, 48.0.4 and 49.0.2. Upgrade to the fixed version on the release line in use.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA wasmtime (bytecodealliance) Fixed in 36.0.17, 48.0.4, 49.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-22
bytecodealliance wasmtime 36.0.17, 48.0.4, 49.0.2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-79466 Unbounded memory allocation in Wasmtime SinkOutputStream write-zeroesPriority LOW 26
- TI-2026-79471 Wasmtime fd_readdir discloses uninitialized host memory to guestsPriority LOW 11
Show all 3 records →

Timeline

2026-10-22 Threatist record created from CVE-2026-115380
2026-10-22 Alias added: GHSA-85gj-cvfx-w74q
2026-10-26 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-j366-h8gg-77pm)

TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9

See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences