CVE-2026-27204 Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

What is CVE-2026-27204?

CVE-2026-27204 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested by the guests. This serves as a Denial of Service vector. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 have all been released with the fix for this issue. These versions do not prevent this issue in their default configuration to avoid breaking preexisting behaviors. All versions of Wasmtime have appropriate knobs to prevent this behavior, and Wasmtime 42.0.0-and-later will have these knobs tuned by default to prevent this issue from happening. There are no known workarounds for this issue without upgrading. Embedders are recommended to upgrade and configure their embeddings as necessary to prevent possibly-malicious guests from triggering this issue.

Weakness: CWE-789, CWE-774, CWE-770, CWE-400

Which versions are affected by CVE-2026-27204?

7 open source packages ship an affected version, including wasmtime. It affects 1 product.

Products include Bytecodealliance Wasmtime.

How do I fix CVE-2026-27204?

Upgrade wasmtime to a fixed version for your release line: 24.0.6, 36.0.6, 40.0.4 or 41.0.4.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-27204 being exploited?

There is no known exploitation of CVE-2026-27204 in the wild and no public exploit code.

Other vulnerabilities in bytecodealliance wasmtime

• CVE-2026-34971 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift Critical 9.0
• CVE-2026-34987 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access Critical 9.0
• CVE-2022-39393 Wasmtime vulnerable to data leakage between instances in the pooling allocator High 8.6
• CVE-2022-24791 Use after free in Wasmtime High 8.1
• CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-27204, GHSA-852m-cvvp-9p4w, JLSEC-2026-1352, RUSTSEC-2026-0020, UBUNTU-CVE-2026-27204.