# CVE-2026-27572: Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance > Attackers can cause a Denial of Service in Wasmtime by adding excessive fields to HTTP headers, triggering a panic in the runtime. - **Severity:** Medium 6.9 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 24 Feb 2026 - **Updated:** 27 Feb 2026 - **Also known as:** DEBIAN-CVE-2026-27572, GHSA-243v-98vx-264h, JLSEC-2026-1353, RUSTSEC-2026-0021, UBUNTU-CVE-2026-27572 ## What is CVE-2026-27572? CVE-2026-27572 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. ### Official description Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime. Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) ## Which versions are affected by CVE-2026-27572? 7 open source packages ship an affected version, including wasmtime. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `wasmtime` | crates.io | All versions | 24.0.6 | | `wasmtime` | crates.io | All versions | 24.0.6 | | `wasmtime` | crates.io | From 0.0.0-0 | 24.0.6, 36.0.6, 40.0.4, 41.0.4 | | `wasmtime` | crates.io | From 25.0.0 | 36.0.6 | | `wasmtime` | crates.io | From 25.0.0 | 36.0.6 | | `wasmtime` | crates.io | From 37.0.0 | 40.0.4 | | `wasmtime` | crates.io | From 37.0.0 | 40.0.4 | Products: Bytecodealliance Wasmtime. ## How do I fix CVE-2026-27572? Upgrade wasmtime to a fixed version for your release line: 24.0.6, 36.0.6, 40.0.4 or 41.0.4. ## Is CVE-2026-27572 being exploited? There is no known exploitation of CVE-2026-27572 in the wild and no public exploit code. ## Other vulnerabilities in bytecodealliance wasmtime - [CVE-2026-34971](https://insights.sbomify.com/CVE-2026-34971/): Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift (critical 9.0) - [CVE-2026-34987](https://insights.sbomify.com/CVE-2026-34987/): Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access (critical 9.0) - [CVE-2022-39393](https://insights.sbomify.com/CVE-2022-39393/): Wasmtime vulnerable to data leakage between instances in the pooling allocator (high 8.6) - [CVE-2022-24791](https://insights.sbomify.com/CVE-2022-24791/): Use after free in Wasmtime (high 8.1) - [CVE-2026-47261](https://insights.sbomify.com/CVE-2026-47261/): Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction (high 7.5) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-27572 and fix it if it is affected. What it is: CVE-2026-27572 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 24 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of CVE-2026-27572 in the wild and no public exploit code. Affected packages and fixed versions: - wasmtime (crates.io): affected all versions; fixed in 24.0.6 - wasmtime (crates.io): affected all versions; fixed in 24.0.6 - wasmtime (crates.io): affected from 0.0.0-0; fixed in 24.0.6, 36.0.6, 40.0.4, 41.0.4 - wasmtime (crates.io): affected from 25.0.0; fixed in 36.0.6 - wasmtime (crates.io): affected from 25.0.0; fixed in 36.0.6 - wasmtime (crates.io): affected from 37.0.0; fixed in 40.0.4 - wasmtime (crates.io): affected from 37.0.0; fixed in 40.0.4 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-27572/ (Markdown: https://insights.sbomify.com/CVE-2026-27572/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-27572 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27572 - OSV: https://osv.dev/vulnerability/CVE-2026-27572 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-27572/ Summaries are generated and may contain mistakes; the official description above is the record.