{"answers":{"affected":"7 open source packages ship an affected version, including wasmtime. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-27572 in the wild and no public exploit code.","fix":"Upgrade wasmtime to a fixed version for your release line: 24.0.6, 36.0.6, 40.0.4 or 41.0.4.","what":"CVE-2026-27572 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-27572 and fix it if it is affected.\n\nWhat it is: CVE-2026-27572 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-27572 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- wasmtime (crates.io): affected all versions; fixed in 24.0.6\n- wasmtime (crates.io): affected all versions; fixed in 24.0.6\n- wasmtime (crates.io): affected from 0.0.0-0; fixed in 24.0.6, 36.0.6, 40.0.4, 41.0.4\n- wasmtime (crates.io): affected from 25.0.0; fixed in 36.0.6\n- wasmtime (crates.io): affected from 25.0.0; fixed in 36.0.6\n- wasmtime (crates.io): affected from 37.0.0; fixed in 40.0.4\n- wasmtime (crates.io): affected from 37.0.0; fixed in 40.0.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27572/ (Markdown: https://insights.sbomify.com/CVE-2026-27572/index.md)","id":"CVE-2026-27572","markdown":"https://insights.sbomify.com/CVE-2026-27572/index.md","name":"CVE-2026-27572","record":{"aliases":["DEBIAN-CVE-2026-27572","GHSA-243v-98vx-264h","JLSEC-2026-1353","RUSTSEC-2026-0021","UBUNTU-CVE-2026-27572"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"WebAssembly runtime","requires_auth":"low_privilege","summary":"Attackers can cause a Denial of Service in Wasmtime by adding excessive fields to HTTP headers, triggering a panic in the runtime.","user_interaction":"required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"wasmtime","vendor":"bytecodealliance"}],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","version":"4.0"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"description":"Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance","id":"CVE-2026-27572","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":7,"n_references":7,"next":{"headline":"Further research determined the situation described is not a vulnerability.","id":"CVE-2026-27573"},"packages":[{"ecosystem":"crates.io","fixed":["24.0.6"],"introduced":["0"],"last_affected":[],"package":"wasmtime","purl":null,"source":"GHSA-243v-98vx-264h"},{"ecosystem":"crates.io","fixed":["24.0.6"],"introduced":["0"],"last_affected":[],"package":"wasmtime","purl":"pkg:cargo/wasmtime","source":"GHSA-243v-98vx-264h"},{"ecosystem":"crates.io","fixed":["24.0.6","36.0.6","40.0.4","41.0.4"],"introduced":["0.0.0-0","25.0.0","37.0.0","41.0.0"],"last_affected":[],"package":"wasmtime","purl":"pkg:cargo/wasmtime","source":"RUSTSEC-2026-0021"},{"ecosystem":"crates.io","fixed":["36.0.6"],"introduced":["25.0.0"],"last_affected":[],"package":"wasmtime","purl":null,"source":"GHSA-243v-98vx-264h"},{"ecosystem":"crates.io","fixed":["36.0.6"],"introduced":["25.0.0"],"last_affected":[],"package":"wasmtime","purl":"pkg:cargo/wasmtime","source":"GHSA-243v-98vx-264h"},{"ecosystem":"crates.io","fixed":["40.0.4"],"introduced":["37.0.0"],"last_affected":[],"package":"wasmtime","purl":null,"source":"GHSA-243v-98vx-264h"},{"ecosystem":"crates.io","fixed":["40.0.4"],"introduced":["37.0.0"],"last_affected":[],"package":"wasmtime","purl":"pkg:cargo/wasmtime","source":"GHSA-243v-98vx-264h"}],"prev":{"headline":"nats-server websockets are vulnerable to pre-auth memory DoS","id":"CVE-2026-27571"},"products":["wasmtime"],"published":"2026-02-24","related":[{"cvss_score":9,"headline":"Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift","id":"CVE-2026-34971","kev_date_added":null,"published":"2026-04-09"},{"cvss_score":9,"headline":"Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access","id":"CVE-2026-34987","kev_date_added":null,"published":"2026-04-09"},{"cvss_score":8.6,"headline":"Wasmtime vulnerable to data leakage between instances in the pooling allocator","id":"CVE-2022-39393","kev_date_added":null,"published":"2022-11-10"},{"cvss_score":8.1,"headline":"Use after free in Wasmtime","id":"CVE-2022-24791","kev_date_added":null,"published":"2022-03-31"},{"cvss_score":7.5,"headline":"Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","id":"CVE-2026-47261","kev_date_added":null,"published":"2026-06-15"},{"cvss_score":6.9,"headline":"Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding","id":"CVE-2026-34941","kev_date_added":null,"published":"2026-04-09"},{"cvss_score":6.9,"headline":"Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future","id":"CVE-2026-27195","kev_date_added":null,"published":"2026-02-24"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-02-27","vendors":["bytecodealliance"]},"summary":"Attackers can cause a Denial of Service in Wasmtime by adding excessive fields to HTTP headers, triggering a panic in the runtime.","url":"https://insights.sbomify.com/CVE-2026-27572/"}