Vulnerabilities

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion…

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Bytecodealliance

Product

wasmtime

CVSS v3.1

4.8 AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness

CWE-617

NVD status

Deferred

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-119138 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 7
   CVE NVD 7d ago

   Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the…

   CVSS 5.3 CVE-2026-119141 Bytecodealliance
2. 3
   CVE NVD 7d ago

   Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host…

   CVSS 4.8 CVE-2026-119140 Bytecodealliance