Panic in Wasmtime when a guest receives a host stream of another type
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.
Summary
Wasmtime from 46.0.0 before 48.0.7 and from 49.0.0 before 49.0.4 is affected. A missing payload-type check lets a host-created component model stream or future, after passing through guest code, reach a guest that expects a different payload type (CWE-843). A malicious guest that controls exported function types or returned values can crash the Wasmtime host with a panic.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bytecodealliance | wasmtime | 46.0.0 to before 48.0.7; 49.0.0 to before 49.0.4 | 48.0.7, 49.0.4 | Patch available | CNA |
| — | wasmtime (crates.io) | 46.0.0 to before 48.0.7 | 48.0.7 | Patch available | GHSA-9pvw-hwfg-92h5 |
| — | wasmtime (crates.io) | 49.0.0 to before 49.0.4 | 49.0.4 | Patch available | GHSA-9pvw-hwfg-92h5 |
- wasmtime Vendorbytecodealliance Affected 46.0.0 to before 48.0.7; 49.0.0 to before 49.0.4 Fixed in 48.0.7, 49.0.4 Patch available CNA
- wasmtime (crates.io) Vendor— Affected 46.0.0 to before 48.0.7 Fixed in 48.0.7 Patch available GHSA-9pvw-hwfg-92h5
- wasmtime (crates.io) Vendor— Affected 49.0.0 to before 49.0.4 Fixed in 49.0.4 Patch available GHSA-9pvw-hwfg-92h5
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* | — | — | bytecodealliance |
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance
Remediation
Upgrade Wasmtime to 48.0.7 or 49.0.4. Red Hat lists no available fix plan for Red Hat Connectivity Link 1 and Red Hat Enterprise Linux 10.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA wasmtime (bytecodealliance) Fixed in 48.0.7, 49.0.4
- Fix · GHSA-9pvw-hwfg-92h5 wasmtime (crates.io) Fixed in 48.0.7 Advisory →
- Fix · GHSA-9pvw-hwfg-92h5 wasmtime (crates.io) Fixed in 49.0.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115892
- 2026-10-23 Alias added: GHSA-9pvw-hwfg-92h5
- 2026-10-23 Fix available: crates.io/[email protected], crates.io/[email protected] · GHSA-9pvw-hwfg-92h5
- 2026-10-23 CVSS score added · GHSA-9pvw-hwfg-92h5
- 2026-10-23 Weakness changed · GHSA-9pvw-hwfg-92h5
- 2026-10-23 11 new references · GHSA-9pvw-hwfg-92h5
- 2026-10-24 Priority changed: MEDIUM → LOW
- 2026-10-24 Affected versions changed · Red Hat
- 2026-10-24 CVSS score added · Red Hat
- 2026-10-29 CISA SSVC decision points changed
References
Other 11
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5
- https://github.com/bytecodealliance/wasmtime/pull/14819
- https://github.com/bytecodealliance/wasmtime/pull/14820
- https://github.com/bytecodealliance/wasmtime/pull/14827
- https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
- https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158
- https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
- https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7
- https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4
- https://github.com/bytecodealliance/wasmtime
- https://rustsec.org/advisories/RUSTSEC-2026-0378.html
More bytecodealliance vulnerabilities
- TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
- TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
- TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
- TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
- TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
- TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-115892 · CVE Program
- CVE-2026-115892 · NVD
- FIRST EPSS
- GHSA-9pvw-hwfg-92h5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115892 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences