Skip to content
Fencer Vulns
medium 6.5

CVE-2026-27204 json

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

published 2026-02-24 8 mo ago modified 2026-10-12 27 d ago also EUVD-2026-8568 , GHSA-852m-cvvp-9p4w , JLSEC-2026-1352 , RUSTSEC-2026-0020

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested by the guests. This serves as a Denial of Service vector. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 have all been released with the fix for this issue. These versions do not prevent this issue in their default configuration to avoid breaking preexisting behaviors. All versions of Wasmtime have appropriate knobs to prevent this behavior, and Wasmtime 42.0.0-and-later will have these knobs tuned by default to prevent this issue from happening. There are no known workarounds for this issue without upgrading. Embedders are recommended to upgrade and configure their embeddings as necessary to prevent possibly-malicious guests from triggering this issue.

Patch / fix

  • crates.io wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4
  • julia Wasmtime_jll 45.0.1+0
  • bytecodealliance wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4
  • rust-wasmtime Debian 14 36.0.6+dfsg-1

debian advisories DEBIAN-CVE-2026-27204

  • zed openSUSE Tumbleweed 1.24.2-1.1

opensuse advisories openSUSE-SU-2026:12355-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27204 updated cvss 6.3

wasmtime: Wasmtime: Denial of Service via guest-controlled resource exhaustion in WASI host interfaces

  • Red Hat Connectivity Link 1 rhcl-1/wasm-shim-rhel9
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io wasmtime
<24.0.6
>=25.0.0, <36.0.6
>=37.0.0, <40.0.4
>=0.0.0-0, <24.0.6
>=41.0.0, <41.0.4
24.0.6
36.0.6
40.0.4
41.0.4
julia Wasmtime_jll
<45.0.1+0
45.0.1+0

Affected products

  • bytecodealliance wasmtime

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-774 Allocation of File Descriptors or Handles Without Limits or Throttling
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.