CVE-2026-115389

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.16 Wasmtime versions 37.0.0 through 48.0.2 Wasmtime versions 49.0.0 through 49.0.0

Description The software fails to adequately account for host allocations when lifting guest values through the dynamically-typed Val API. This allows a malicious WebAssembly guest to bypass the hostcall fuel limit by returning crafted values that allocate approximately 100 times more host memory than is tracked, leading to a denial of service.

Recommendations Update to version 36.0.16 or later. Update to version 48.0.3 or later. Update to version 49.0.1 or later.