Reachable assertion in Wasmtime - #VU155844
Published: October 15, 2026
Vulnerability identifier: #VU155844
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a reachable panic on a Rust type mismatch in the StreamReader read optimization when the host reads a stream returned through guest code with a different Rust-level item type. A remote user can return a host-created stream through guest code using a different Rust-level item type to cause a denial of service.
The two Rust item types must correspond to the same component model type, and the host must hold both the read and write ends of the stream.
Affected software
Wasmtime
Remediation
Install security update from vendor's website.
Wasmtime - addressed in versions 48.0.6, 49.0.3