CVE-2026-115380: Allocation of Resources Without Limits or Throttling in bytecodealliance wasmtime
Description
CVE-2026-115380 is a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter of the wasmtime runtime. It affects versions before 36.0.17, versions from 37.0.0 up to but not including 48.0.4, and versions from 49.0.0 up to but not including 49.0.2. The vulnerability arises because the adapter performs O(n) host work per subscription without consuming or checking fuel, allowing malicious guest modules to cause long-running host computations that ignore configured fuel limits.
CVSS v4.0
Score 5.1medium
Affected software
bytecodealliance
wasmtime
pkg:cargo/github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The wasmtime runtime's wasmtime-wasi WASI preview 0 poll_oneoff adapter has a resource allocation vulnerability where it performs linear host work per subscription without enforcing fuel consumption or limits. This flaw enables malicious guest modules to submit many subscriptions, triggering excessive host computation and resulting in denial of service. The affected versions are before 36.0.17, from 37.0.0 up to 48.0.4, and from 49.0.0 up to 49.0.2. The CVSS 4.0 score is 5.1 (medium severity), indicating a locally exploitable denial of service without privileges or user interaction.
Potential Impact
An attacker controlling guest modules can cause denial of service by forcing the host to perform long-running computations that bypass configured fuel limits, potentially degrading or halting service availability on affected wasmtime runtimes.
Mitigation Recommendations
Patch to versions 36.0.17 or later, 48.0.4 or later, and 49.0.2 or later where this issue is fixed. Since no vendor advisory or patch links are provided, check the official bytecodealliance wasmtime release notes or security advisories for the exact fixed versions and apply updates accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:25:27.610Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada64a34d27ba8daa756572
Added to database: 10/22/2026, 19:31:47 UTC
Last enriched: 10/22/2026, 20:31:29 UTC
Last updated: 10/22/2026, 21:15:32 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.