Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: bytecodealliance wasmtime 36.0.18, 48.0.6, 49.0.3 Clear all filters
TI-2026-82652 CVE-2026-119134 · GHSA-59gg-q3p6-vwvr

Unbounded memory growth in Wasmtime via resource handles

Priority LOW 29

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits…

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00153 Published 2026-10-29 Partial fix · 36.0.18, 48.0.6 +1 CWE-770
TI-2026-82648 CVE-2026-119130 · GHSA-pr9x-c379-2x4g

Wasmtime HTTP target smuggling lets guests reach disallowed hosts

Priority LOW 11

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request…

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00236 Published 2026-10-29 Fixed in 36.0.18, 48.0.6 +1 CWE-20