CVE-2026-115390

EUVD-2026-108321
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.7 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.59%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
bytecodealliancewasmtime
47.0.0 ≤
𝑥
< 48.0.3
CNA
bytecodealliancewasmtime
49.0.0 ≤
𝑥
< 49.0.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-wasmtime
forky
36.0.13+dfsg-1
fixed
sid
36.0.13+dfsg-1
fixed
trixie
26.0.1+dfsg-3
fixed
Common Weakness Enumeration
References
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x
https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.3-and-49.0.0-before-49.0.1-fuel-accounting-bypass-dos