CVE-2026-115380
CVE-2026-115380 · Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
CVSS 5.1 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
wasmtime
- Versions
- ≥ 0, < 36.0.17: Affected (semver)
- 36.0.17: Not affected (semver)
- ≥ 37.0.0, < 48.0.4: Affected (semver)
- 48.0.4: Not affected (semver)
- ≥ 49.0.0, < 49.0.2: Affected (semver)
- 49.0.2: Not affected (semver)
Update to 36.0.17; Update to 48.0.4; Update to 49.0.2
rust-wasmtime Debian:13
- Versions
- 26.0.1+dfsg-10
- 26.0.1+dfsg-3
- 26.0.1+dfsg-4
- 26.0.1+dfsg-5
- 26.0.1+dfsg-6
- 26.0.1+dfsg-7
- 26.0.1+dfsg-8
- 26.0.1+dfsg-9
- 27.0.0+dfsg-2
- 27.0.0+dfsg-3
- 27.0.0+dfsg-4
- 28.0.1+dfsg-1
- 28.0.1+dfsg-2
- 28.0.1+dfsg-3
- 29.0.1+dfsg-1
- 29.0.1+dfsg-2
- 29.0.1+dfsg-3
- 29.0.1+dfsg-4
- 29.0.1+dfsg-5
- 29.0.1+dfsg-6
- 29.0.1+dfsg-7
- 29.0.1+dfsg-8
- 36.0.11+dfsg-1
- 36.0.12+dfsg-1
- 36.0.12+dfsg-2
- 36.0.12+dfsg-3
- 36.0.13+dfsg-1
- 36.0.5+dfsg-1
- 36.0.5+dfsg-2
- 36.0.5+dfsg-3
- 36.0.5+dfsg-4
- 36.0.5+dfsg-5
- 36.0.6+dfsg-1
- 36.0.6+dfsg-2
- 36.0.6+dfsg-3
- 36.0.6+dfsg-4
- 36.0.6+dfsg-5
- 36.0.6+dfsg-6
- 36.0.6+dfsg-7
- 36.0.7+dfsg-1
- 36.0.8+dfsg-1
- 36.0.9+dfsg-1
- 36.0.9+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-wasmtime Debian:14
- Versions
- 26.0.1+dfsg-10
- 26.0.1+dfsg-3
- 26.0.1+dfsg-4
- 26.0.1+dfsg-5
- 26.0.1+dfsg-6
- 26.0.1+dfsg-7
- 26.0.1+dfsg-8
- 26.0.1+dfsg-9
- 27.0.0+dfsg-2
- 27.0.0+dfsg-3
- 27.0.0+dfsg-4
- 28.0.1+dfsg-1
- 28.0.1+dfsg-2
- 28.0.1+dfsg-3
- 29.0.1+dfsg-1
- 29.0.1+dfsg-2
- 29.0.1+dfsg-3
- 29.0.1+dfsg-4
- 29.0.1+dfsg-5
- 29.0.1+dfsg-6
- 29.0.1+dfsg-7
- 29.0.1+dfsg-8
- 36.0.11+dfsg-1
- 36.0.12+dfsg-1
- 36.0.12+dfsg-2
- 36.0.12+dfsg-3
- 36.0.13+dfsg-1
- 36.0.5+dfsg-1
- 36.0.5+dfsg-2
- 36.0.5+dfsg-3
- 36.0.5+dfsg-4
- 36.0.5+dfsg-5
- 36.0.6+dfsg-1
- 36.0.6+dfsg-2
- 36.0.6+dfsg-3
- 36.0.6+dfsg-4
- 36.0.6+dfsg-5
- 36.0.6+dfsg-6
- 36.0.6+dfsg-7
- 36.0.7+dfsg-1
- 36.0.8+dfsg-1
- 36.0.9+dfsg-1
- 36.0.9+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published