CVE-2026-115382
CVE-2026-115382 · Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.
CVSS 5.9 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
wasmtime
- Versions
- ≥ 46.0.0, < 48.0.4: Affected (semver)
- 48.0.4: Not affected (semver)
- ≥ 49.0.0, < 49.0.2: Affected (semver)
- 49.0.2: Not affected (semver)
Update to 48.0.4; Update to 49.0.2