CVE-2026-115380

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.17 Wasmtime versions 37.0.0 through 48.0.3 Wasmtime versions 49.0.0 through 49.0.1

Description A denial of service issue exists in the wasmtime-wasi WASI preview 0 poll oneoff adapter. The adapter performs O(n) host work per subscription without consuming or checking fuel, which is a mechanism used to limit the amount of computation a guest module can perform. Malicious guest modules can provide numerous subscriptions to trigger long-running host computations that bypass configured fuel limits.

Recommendations Update to version 36.0.17 or later. Update to version 48.0.4 or later. Update to version 49.0.2 or later.