SB2026101528 - Multiple vulnerabilities in Wasmtime

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101528

SB2026101528 - Multiple vulnerabilities in Wasmtime

Published: October 15, 2026

Security Bulletin ID SB2026101528
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 27% Low 73%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass host filtering policies and send HTTP requests to disallowed hosts.

The vulnerability exists due to improper input validation in the wasmtime-wasi-http implementation of wasi:http when processing guest-supplied outgoing request paths. A remote user can supply an absolute-form URL to set-path-with-query to bypass host filtering policies and send HTTP requests to disallowed hosts.

Exploitation requires the allowed authority to be a forward proxy or gateway that honors absolute-form request targets. Wasmtime connects to the configured authority and uses it for the Host header, but the intermediary can forward the request according to the absolute-form target instead.


2) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the http crate used by wasmtime-wasi-http when processing guest-supplied request URLs. A remote attacker can use the WASI HTTP set-path-with-query operation to supply a URL with a query delimiter occurring after byte 65535 to cause a denial of service.

Exploitation requires the wrapped delimiter index to fall on an invalid character boundary.


3) UNIX symbolic link following (CVE-ID: N/A)

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escape the filesystem sandbox and read and modify external directories accessible to the host process.

The vulnerability exists due to improper symbolic link following in the wasmtime-wasi filesystem implementation when renaming a symbolic link with a trailing slash. A remote user can create a relative symbolic link pointing to an external directory and rename it with a trailing slash to a path inside the sandbox to escape the filesystem sandbox and read and modify external directories accessible to the host process.

Exploitation requires guest write access to a directory within the sandbox. The issue affects macOS and FreeBSD, but not Linux or Windows. Only symbolic links to directories can be used. The supplied CVSS vector indicates that user interaction is required.


4) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a reachable assertion in fused component adapters when transferring strings during same-instance component-to-component calls. A remote user can trigger a string transfer whose source and destination alias each other to cause a denial of service.

The issue can be triggered during normal default execution of a WebAssembly guest. User interaction is required.


5) Reliance on Data/Memory Layout (CVE-ID: N/A)

CWE-ID: CWE-188 - Reliance on Data/Memory Layout

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause undefined behavior in the host.

The vulnerability exists due to improper alignment of host data structures in Wasmtime's VMContext layout logic when processing WebAssembly modules containing an odd number of exception tags. A remote user can supply such a module to cause undefined behavior in the host.

Only embedders with WebAssembly exceptions enabled are affected. No exploitable consequence was known at the time of publication.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without store-wide limits in Wasmtime's component-model handle tables when processing guest resource allocations. A remote attacker can repeatedly instantiate a sub-component and allocate resource handles to cause a denial of service.

Exploitation is possible with the default configuration and requires no linear memory, core tables, or host imports. Handle-table allocations are not charged to ResourceLimiter or StoreLimits.


7) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a reachable panic on a Rust type mismatch in the StreamReader read optimization when the host reads a stream returned through guest code with a different Rust-level item type. A remote user can return a host-created stream through guest code using a different Rust-level item type to cause a denial of service.

The two Rust item types must correspond to the same component model type, and the host must hold both the read and write ends of the stream.


8) Improper Enforcement of Behavioral Workflow (CVE-ID: N/A)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to insufficient enforcement of async-entrypoint requirements in the Wasmtime store when host functions re-enter WebAssembly through synchronous APIs during an asynchronous call and the store does not otherwise require asynchronous entrypoints. A remote user can trigger affected embedder execution paths to cause a denial of service through runtime panics in certain scheduling situations.

The issue cannot be controlled by guest code. Stack-resident non-Send values, such as Rc<T>, can additionally make suspension and movement of host code across threads unsound.


9) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a reachable assertion in Wasmtime's store and event loop handling when a previously started call proceeds after a trap has left the store in an inconsistent, poisoned state. A remote user can trigger a trap through misbehaving guest code to cause a denial of service.

Exploitation depends on embedder code allowing pending tasks to continue after the error. User interaction is required.


10) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a reachable assertion in Wasmtime's component::Func::call when invoking guest exports that use the async ABI option. A remote user can cause an async-lifted guest export to be invoked through this function to cause a denial of service through a host panic.

User interaction is required.


11) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the Wasmtime type registry when removing the top-level type from a long chain of recursive types. A remote attacker can define a long chain of types in a guest to cause a denial of service by exhausting the host stack and crashing the host.


Remediation

Install update from vendor's website.

References