CVE-2026-115390

Name of the Vulnerable Software and Affected Versions Wasmtime versions 47.0.0 through 48.0.2 Wasmtime versions 49.0.0 through 49.0.0

Description A fuel accounting flaw exists in Cranelift-compiled call ref and try table catch paths. This issue allows malicious guests to reset consumed fuel after calls, enabling them to run for an exponentially long time on linear fuel. This behavior evades timeouts and periodic yields, potentially leading to a denial of service.

Recommendations Update Wasmtime versions 47.0.0 through 48.0.2 to version 48.0.3. Update Wasmtime version 49.0.0 to version 49.0.1.