Every CVE Search/ Get API key

CVE-2026-115382

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

5.9 MediumFix available

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.28%Up 0.1 points since Oct 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Record
CVE-2026-115382
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
EUVDEUVD-2026-108308 5.9

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Record
EUVD-2026-108308
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5gfg-32ph-pxg9 5.9

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability...

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Record
GHSA-5gfg-32ph-pxg9
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
NVD 5.9

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Record
CVE-2026-115382
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-1284
Updated
2026-11-02
OSV 5.9

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Record
CVE-2026-115382
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1284
Updated
2026-11-02
OSVRUSTSEC-2026-0320 5.9

Wasmtime wasi:http implementation panics with a zero timeout supplied

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv For more information see the GitHub-hosted security advisory.

Record
RUSTSEC-2026-0320
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-115382 5.9

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Record
UBUNTU-CVE-2026-115382
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wasmtime-wasi-http
crates.io
 46.0.0 up to 48.0.4, 49.0.0 up to 49.0.2
48.0.449.0.2
rust-wasmtime
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3
 None known
rust-wasmtime
Ubuntu:26.10
 All versions, plus listed versions
36.0.5+dfsg-136.0.13+dfsg-1
 None known
rust-wasmtime
Ubuntu:26.04:LTS
 All versions, plus listed versions
26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-115382 is a medium vulnerability (CVSS 5.9) in Bytecodealliance Wasmtime, published October 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in wasmtime-wasi-http 48.0.4.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open