VYPR
← All advisories
Medium severity6.2NVD Advisory· Published Oct 29, 2026· Updated Oct 29, 2026

CVE-2026-119134

CVE-2026-119134

Description

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Bytecodealliance/Wasmtimeinferred2 versions
    P+ 1 more
    • (no CPE)range: P
    • (no CPE)range: <36.0.18, 37.0.0-<48.0.6, 49.0.0-<49.0.3

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.