CVE-2026-126410 json
Wasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Sockets
published 15d ago modified 7h ago also EUVD-2026-125033 , GHSA-hmmr-87qq-258j , RUSTSEC-2026-0420
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a time-of-check/time-of-use race in the wasip3 wasi:sockets udp-socket host implementation that lets guests bypass socket_addr_check send restrictions. A malicious guest can race udp-socket.send against udp-socket.connect to deliver attacker-controlled datagrams to addresses the policy permits only for receiving.
Patch / fix
- crates.io wasmtime-wasi 48.0.8, 49.0.5, 50.0.1
- bytecodealliance wasmtime 48.0.8, 49.0.5, 50.0.1
- github.com/bytecodealliance/wasmtime#15077 pull request
Is CVE-2026-126410 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime-wasi | >=48.0.0, <48.0.8 >=49.0.0, <49.0.5 >=50.0.0, <50.0.1 |
48.0.8 49.0.5 50.0.1 |
Affected products
- bytecodealliance wasmtime
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
-
github.com
/bytecodealliance/wasmtime/pull/15077
web
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j
vendor-advisory, advisory
-
vulncheck.com
/advisories/wasmtime-48.0.0-before-48.0.8-toctou-udp-send-policy-bypass-via-wasip3-sockets
third-party-advisory
-
crates.io
/crates/wasmtime-wasi
package
-
rustsec.org
/advisories/RUSTSEC-2026-0420.html
advisory
Sources
- CVE List CVE-2026-126410
- NVD CVE-2026-126410
- OSV RUSTSEC-2026-0420
- Maintainer advisory GHSA-hmmr-87qq-258j
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of bytecodealliance/wasmtime published their own advisory on GitHub. Reviewed sources take precedence over it.