Low severity2.3NVD Advisory· Published Oct 22, 2026· Updated Oct 22, 2026
CVE-2026-115389
CVE-2026-115389
Description
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
Affected products
1- Range: <36.0.16, 37.0.0-48.0.3, 49.0.0-49.0.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.