{"id":"CVE-2026-44216","aliases":["DEBIAN-CVE-2026-44216","EUVD-2026-30304","GHSA-p8xm-42r7-89xg","JLSEC-2026-1365","RHSA-2026:45341","RUSTSEC-2026-0114","SUSE-SU-2026:22002-1","UBUNTU-CVE-2026-44216","openSUSE-SU-2026:10802-1","openSUSE-SU-2026:20863-1"],"status":"published","title":"Wasmtime: Panic when allocating a table exceeding the size of the host's address space","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00319,"percentile":0.25176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-770"],"published":"2026-04-30T12:00:00Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"crates.io","package":"wasmtime","fixed_in":["36.0.8","43.0.2","44.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-wasmtime","fixed_in":["36.0.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Wasmtime_jll","fixed_in":["45.0.1+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tree-sitter","fixed_in":["0.26.8-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tree-sitter","fixed_in":["0.26.8-160000.2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tree-sitter","fixed_in":["0.26.8-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.0.0"},{"fixed":"36.0.8"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"37.0.0"},{"fixed":"43.0.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-10","26.0.1+dfsg-3","26.0.1+dfsg-4","26.0.1+dfsg-5","26.0.1+dfsg-6","26.0.1+dfsg-7","26.0.1+dfsg-8","26.0.1+dfsg-9","27.0.0+dfsg-2","27.0.0+dfsg-3","27.0.0+dfsg-4","28.0.1+dfsg-1","28.0.1+dfsg-2","28.0.1+dfsg-3","29.0.1+dfsg-1","29.0.1+dfsg-2","29.0.1+dfsg-3","29.0.1+dfsg-4","29.0.1+dfsg-5","29.0.1+dfsg-6","29.0.1+dfsg-7","29.0.1+dfsg-8","36.0.11+dfsg-1","36.0.12+dfsg-1","36.0.12+dfsg-2","36.0.12+dfsg-3","36.0.13+dfsg-1","36.0.5+dfsg-1","36.0.5+dfsg-2","36.0.5+dfsg-3","36.0.5+dfsg-4","36.0.5+dfsg-5","36.0.6+dfsg-1","36.0.6+dfsg-2","36.0.6+dfsg-3","36.0.6+dfsg-4","36.0.6+dfsg-5","36.0.6+dfsg-6","36.0.6+dfsg-7","36.0.7+dfsg-1","36.0.8+dfsg-1","36.0.9+dfsg-1","36.0.9+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.0.8+dfsg-1"}]}],"versions":["26.0.1+dfsg-10","26.0.1+dfsg-3","26.0.1+dfsg-4","26.0.1+dfsg-5","26.0.1+dfsg-6","26.0.1+dfsg-7","26.0.1+dfsg-8","26.0.1+dfsg-9","27.0.0+dfsg-2","27.0.0+dfsg-3","27.0.0+dfsg-4","28.0.1+dfsg-1","28.0.1+dfsg-2","28.0.1+dfsg-3","29.0.1+dfsg-1","29.0.1+dfsg-2","29.0.1+dfsg-3","29.0.1+dfsg-4","29.0.1+dfsg-5","29.0.1+dfsg-6","29.0.1+dfsg-7","29.0.1+dfsg-8","36.0.5+dfsg-1","36.0.5+dfsg-2","36.0.5+dfsg-3","36.0.5+dfsg-4","36.0.5+dfsg-5","36.0.6+dfsg-1","36.0.6+dfsg-2","36.0.6+dfsg-3","36.0.6+dfsg-4","36.0.6+dfsg-5","36.0.6+dfsg-6","36.0.6+dfsg-7","36.0.7+dfsg-1"]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"30.0.0"},{"fixed":"36.0.8"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"43.0.2"}]}]},{"source":"osv","ecosystem":"Julia","package":"Wasmtime_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"39.0.0+0"},{"fixed":"45.0.1+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"30.0.0"},{"fixed":"36.0.8"},{"introduced":"37.0.0"},{"fixed":"43.0.2"},{"introduced":"44.0.0"},{"fixed":"44.0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tree-sitter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.8-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tree-sitter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.8-160000.2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+dfsg-7","15.0.1+dfsg-4","16.0.0+dfsg-2","16.0.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["36.0.5+dfsg-1","36.0.13+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-3","26.0.1+dfsg-4","28.0.1+dfsg-3","29.0.1+dfsg-5","36.0.5+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tree-sitter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.8-3.1"}]}]}],"products":[{"vendor":"bytecodealliance","product":"wasmtime"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44216","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477467","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44216.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45341","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0114.html","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44216","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-p8xm-42r7-89xg","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44216.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44216","tags":["advisory"]},{"url":"https://github.com/bytecodealliance/wasmtime","tags":["package"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11233","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51540","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51536","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51538","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45341.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2400867","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11233","tags":["advisory"]},{"url":"https://github.com/rust-lang/rust/pull/141864","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44216","tags":["advisory","report"]},{"url":"https://crates.io/crates/wasmtime","tags":["package"]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/13245","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622002-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265300","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44216","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-44216","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44216","title":"Wasmtime: Panic when allocating a table exceeding the size of the host's address space","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","status":"published","published":"2026-05-14T14:54:32.975Z","modified":"2026-07-28T12:04:48.026Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770","CWE-190"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-30304","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","status":"published","published":"2026-05-14T14:54:32Z","modified":"2026-07-28T12:04:48Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"ghsa":[{"id":"GHSA-p8xm-42r7-89xg","title":"wasmtime has a panic when allocating a table exceeding the size of the host's address space","description":"### Impact\n\nWasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component.\n\nThis bug does not affect the pooling allocator which limits tables sizes to much less than the required amount to trigger the overflow. This bug is only present for the on-demand instance allocator, which is Wasmtime's default allocator. This bug also requires the `memory64` WebAssembly feature to be enabled, which is on-by-default.\n\nPanicking in the host process is considered a denial-of-service vector for Wasmtime.\n\n### Patches\n\nWasmtime 36.0.8, 43.0.2, and 44.0.1 have all been released which fixes this issue.\n\n### Workarounds\n\nEmbeddings can switch to using the pooling allocator to work around this issue, or the `memory64` WebAssembly proposal can be disabled. Otherwise there is no workaround and users are recommended to upgrade.","status":"published","published":"2026-05-07T00:08:59Z","modified":"2026-05-14T20:49:47Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2026-44216","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","status":"published","published":"2026-05-14T15:16:47.793Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770","CWE-190"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-44216","title":"Wasmtime: Panic when allocating a table exceeding the size of the host's address space","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","status":"published","published":"2026-05-14T14:54:32.975Z","modified":"2026-10-28T02:30:35.430155739Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"DEBIAN-CVE-2026-44216","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","status":"published","published":"2026-05-14T15:16:47.793Z","modified":"2026-10-27T09:47:29.350322863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-p8xm-42r7-89xg","title":"wasmtime has a panic when allocating a table exceeding the size of the host's address space","description":"### Impact\n\nWasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component.\n\nThis bug does not affect the pooling allocator which limits tables sizes to much less than the required amount to trigger the overflow. This bug is only present for the on-demand instance allocator, which is Wasmtime's default allocator. This bug also requires the `memory64` WebAssembly feature to be enabled, which is on-by-default.\n\nPanicking in the host process is considered a denial-of-service vector for Wasmtime.\n\n### Patches\n\nWasmtime 36.0.8, 43.0.2, and 44.0.1 have all been released which fixes this issue.\n\n### Workarounds\n\nEmbeddings can switch to using the pooling allocator to work around this issue, or the `memory64` WebAssembly proposal can be disabled. Otherwise there is no workaround and users are recommended to upgrade.","status":"published","published":"2026-05-07T00:08:59Z","modified":"2026-09-10T03:51:06.59790383Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"JLSEC-2026-1365","title":"wasmtime has a panic when allocating a table exceeding the size of the host's address space","description":"### Impact\n\nWasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component.\n\nThis bug does not affect the pooling allocator which limits tables sizes to much less than the required amount to trigger the overflow. This bug is only present for the on-demand instance allocator, which is Wasmtime's default allocator. This bug also requires the `memory64` WebAssembly feature to be enabled, which is on-by-default.\n\nPanicking in the host process is considered a denial-of-service vector for Wasmtime.\n\n### Patches\n\nWasmtime 36.0.8, 43.0.2, and 44.0.1 have all been released which fixes this issue.\n\n### Workarounds\n\nEmbeddings can switch to using the pooling allocator to work around this issue, or the `memory64` WebAssembly proposal can be disabled. Otherwise there is no workaround and users are recommended to upgrade.","status":"published","published":"2026-08-21T20:43:33.133Z","modified":"2026-08-21T21:14:21.809911344Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2026:45341","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-28T10:13:34Z","modified":"2026-10-16T10:18:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RUSTSEC-2026-0114","title":"Panic when allocating a table exceeding the size of the host's address space","description":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg\nFor more information see the GitHub-hosted security advisory.","status":"published","published":"2026-04-30T12:00:00Z","modified":"2026-10-12T18:00:08.331525891Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-44216","description":"Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.","status":"published","published":"2026-05-14T15:16:00Z","modified":"2026-10-17T12:58:19.068824083Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"openSUSE-SU-2026:10802-1","title":"libtree-sitter0_26-0.26.8-3.1 on GA media","description":"These are all security issues fixed in the libtree-sitter0_26-0.26.8-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-17T00:00:00Z","modified":"2026-05-18T07:45:09.716299Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20863-1","title":"Security update for tree-sitter","description":"This update for tree-sitter fixes the following issue\n\n- CVE-2026-44216: wasmtime: allocation of a table exceeding the size of the host's address space leads to panic\n  (bsc#1265300).\n","status":"published","published":"2026-06-01T08:10:15Z","modified":"2026-06-04T18:24:09.887319539Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22002-1","title":"Security update for tree-sitter","description":"This update for tree-sitter fixes the following issue\n\n- CVE-2026-44216: wasmtime: allocation of a table exceeding the size of the host's address space leads to panic\n  (bsc#1265300).\n","status":"published","published":"2026-06-01T08:14:43Z","modified":"2026-06-09T18:24:27.012712192Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}