CVE-2026-115382

Name of the Vulnerable Software and Affected Versions Wasmtime versions 46.0.0 through 48.0.3 Wasmtime versions 49.0.0 through 49.0.1

Description A denial-of-service issue exists in the wasi:http implementation. Guests can cause the host to panic and crash the host embedding by specifying a zero value for the between-bytes-timeout request option. This value is forwarded directly to a Tokio API, which triggers the panic.

Recommendations Update Wasmtime versions 46.0.0 through 48.0.3 to version 48.0.4. Update Wasmtime versions 49.0.0 through 49.0.1 to version 49.0.2.