CVE-2026-115380Medium· 4.0▾ SunlitWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Last analysed / modified upstream
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
wasmtime < 36.0.17wasmtime >= 37.0.0 < 48.0.4wasmtime >= 49.0.0 < 49.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wasmtime-wasi >= 49.0.0, < 49.0.2Patched in:
wasmtime-wasi 49.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115381Medium· 4.8Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
CVE-2026-115391Medium· 5.8Guest controlled-size host heap allocation through WASIp3 streams
CVE-2026-115389Low· 2.3Dynamic record lifting can allocate beyond the hostcall fuel limit
CVE-2026-115385Medium· 6.2Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
CVE-2026-44216High· 7.5Wasmtime is a runtime for WebAssembly
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type