CVE-2026-27572 Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

What is CVE-2026-27572?

CVE-2026-27572 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.

Weakness: CWE-770

Which versions are affected by CVE-2026-27572?

7 open source packages ship an affected version, including wasmtime. It affects 1 product.

Products include Bytecodealliance Wasmtime.

How do I fix CVE-2026-27572?

Upgrade wasmtime to a fixed version for your release line: 24.0.6, 36.0.6, 40.0.4 or 41.0.4.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-27572 being exploited?

There is no known exploitation of CVE-2026-27572 in the wild and no public exploit code.

Other vulnerabilities in bytecodealliance wasmtime

• CVE-2026-34971 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift Critical 9.0
• CVE-2026-34987 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access Critical 9.0
• CVE-2022-39393 Wasmtime vulnerable to data leakage between instances in the pooling allocator High 8.6
• CVE-2022-24791 Use after free in Wasmtime High 8.1
• CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-27572, GHSA-243v-98vx-264h, JLSEC-2026-1353, RUSTSEC-2026-0021, UBUNTU-CVE-2026-27572.