Fuel accounting flaw in Wasmtime enables denial of service
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
Wasmtime from 47.0.0 before 48.0.3 and from 49.0.0 before 49.0.1 contains a fuel accounting flaw in the Cranelift-compiled call_ref and try_table catch paths, classified as CWE-400. A malicious guest can reset consumed fuel after calls, so it runs for exponentially long, evading timeouts and periodic yields and causing denial of service.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bytecodealliance | wasmtime | 47.0.0 to before 48.0.3; 49.0.0 to before 49.0.1 | 48.0.3, 49.0.1 | Patch available | CNA |
- wasmtime Vendorbytecodealliance Affected 47.0.0 to before 48.0.3; 49.0.0 to before 49.0.1 Fixed in 48.0.3, 49.0.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* | — | — | bytecodealliance |
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance
Remediation
Upgrade Wasmtime to version 48.0.3 or 49.0.1. The sources list no fixed version for Red Hat Connectivity Link 1 and Red Hat Enterprise Linux 10.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA wasmtime (bytecodealliance) Fixed in 48.0.3, 49.0.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-22 Threatist record created from CVE-2026-115390
- 2026-10-22 Alias added: GHSA-78f8-6g96-699x
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-23 CVSS score added · Red Hat
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-23 CISA SSVC decision points changed
References
More bytecodealliance vulnerabilities
- TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
- TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
- TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
- TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
- TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
- TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-115390 · CVE Program
- CVE-2026-115390 · NVD
- FIRST EPSS
- GHSA-78f8-6g96-699x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115390 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences