CVE-2026-115389 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115389?
CVE-2026-115389 is a low-severity vulnerability in bytecodealliance wasmtime, published on 22 Oct 2026.
Official description
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
Weakness: CWE-770
Which versions are affected by CVE-2026-115389?
1 open source package ship an affected version, including wasmtime.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | From 0.0.0-0 | 36.0.16, 48.0.3, 49.0.1 |
How do I fix CVE-2026-115389?
Upgrade wasmtime to a fixed version for your release line: 36.0.16, 48.0.3 or 49.0.1.
Is CVE-2026-115389 being exploited?
There is no known exploitation of CVE-2026-115389 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115389, GHSA-3g9q-2gmg-4cvp, GHSA-jqpg-j7w6-42pr, RUSTSEC-2026-0316, UBUNTU-CVE-2026-115389.