CVE-2026-126407 json
Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer
published 15d ago modified 2h ago also EUVD-2026-125036 , GHSA-6fr9-xmw9-5352 , RUSTSEC-2026-0424
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.
Patch / fix
- crates.io wasmtime 36.0.20, 48.0.8, 49.0.5, 50.0.1
- bytecodealliance wasmtime 36.0.20, 48.0.8, 49.0.5, 50.0.1
- github.com/bytecodealliance/wasmtime#15075 pull request
Is CVE-2026-126407 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2h ago
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime | >=0.0.0-0, <36.0.20 >=37.0.0, <48.0.8 >=49.0.0, <49.0.5 >=50.0.0, <50.0.1 |
36.0.20 48.0.8 49.0.5 50.0.1 |
Affected products
- bytecodealliance wasmtime
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/bytecodealliance/wasmtime/pull/15075
web
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-6fr9-xmw9-5352
vendor-advisory, advisory
-
vulncheck.com
/advisories/wasmtime-before-36.0.20-denial-of-service-via-borrowed-resource-transfer
third-party-advisory
-
crates.io
/crates/wasmtime
package
-
rustsec.org
/advisories/RUSTSEC-2026-0424.html
advisory
Sources
- CVE List CVE-2026-126407
- NVD CVE-2026-126407
- OSV RUSTSEC-2026-0424
- Maintainer advisory GHSA-6fr9-xmw9-5352
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of bytecodealliance/wasmtime published their own advisory on GitHub. Reviewed sources take precedence over it.