CVE-2026-44216 Wasmtime: Panic when allocating a table exceeding the size of the host's address space
An attacker can cause a denial of service by triggering a panic in Wasmtime when allocating an excessively large WebAssembly table.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44216?
CVE-2026-44216 is a medium-severity denial of service vulnerability in bytecodealliance wasmtime, published on 14 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
Which versions are affected by CVE-2026-44216?
5 open source packages ship an affected version, including wasmtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | From 30.0.0 | 36.0.8, 43.0.2, 44.0.1 |
wasmtime crates.io | From 30.0.0 | 36.0.8 |
wasmtime crates.io | From 30.0.0 | 36.0.8 |
wasmtime crates.io | From 37.0.0 | 43.0.2 |
wasmtime crates.io | From 37.0.0 | 43.0.2 |
Linux distribution packages (3)
tree-sitter SUSE:Linux Enterprise Server 16.0 | All versions | 0.26.8-160000.2.1 |
tree-sitter SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.26.8-160000.2.1 |
tree-sitter openSUSE:Tumbleweed | All versions | 0.26.8-3.1 |
Products include Bytecodealliance Wasmtime.
How do I fix CVE-2026-44216?
Upgrade wasmtime to a fixed version for your release line: 36.0.8, 43.0.2 or 44.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44216 being exploited?
There is no known exploitation of CVE-2026-44216 in the wild and no public exploit code.
Other vulnerabilities in bytecodealliance wasmtime
- CVE-2026-34971 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
- CVE-2026-34987 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
- CVE-2022-39393 Wasmtime vulnerable to data leakage between instances in the pooling allocator
- CVE-2022-24791 Use after free in Wasmtime
- CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Sources
Also known as DEBIAN-CVE-2026-44216, GHSA-p8xm-42r7-89xg, JLSEC-2026-1365, RUSTSEC-2026-0114, SUSE-SU-2026:22002-1, UBUNTU-CVE-2026-44216 and 2 more.