Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: bytecodealliance wasmtime 36.0.16, 48.0.3, 49.0.1 Clear all filters
TI-2026-79474 CVE-2026-115389 · GHSA-3g9q-2gmg-4cvp

Wasmtime Denial of Service via Val API

Priority LOW 6

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit.

CVSS 4.0LOW 1.0 Adjacent network Low privileges User interaction EPSS 0.00153 Published 2026-10-22 Partial fix · 36.0.16, 48.0.3 +1 CWE-770
TI-2026-79473 CVE-2026-115388 · GHSA-7qg7-h7wh-p6q8

Unbounded writes in Wasmtime WASI HTTP exhaust host memory

Priority LOW 29

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instea…

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00112 Published 2026-10-22 Fixed in 36.0.16, 48.0.3 +1 CWE-400
TI-2026-79472 CVE-2026-115387 · GHSA-xxx8-c5qx-wvm3

Host panic in Wasmtime WASI filesystem timestamp handling

Priority LOW 29

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00112 Published 2026-10-22 Fixed in 36.0.16, 48.0.3 +1 CWE-190