CVE-2026-115382

Fixed upstream EPSS <1%CVSS 4.8

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Published 2026-10-22 · CVE record · OSV

Products: bytecodealliance wasmtime

Fixed upstream