What’s Vulnerable › Vulnerabilities

CVE-2026-115382: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-23
• Weakness: CWE-1284

Description

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.

Affected products

• bytecodealliance wasmtime: from 46.0.0 before 48.0.4; from 49.0.0 before 49.0.2 — fixed in 48.0.4, 49.0.2

How to fix

Upgrade to a fixed version: bytecodealliance wasmtime 48.0.4, 49.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-wasi-http-zero-timeout-panic-dos

Get alerted when CVE-2026-115382 or the next vulnerability affects your stack