CVE-2026-119142 in Wasmtime
Summary
by MITRE • 10/29/2026
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The WebAssembly runtime Wasmtime contains a critical denial of service vulnerability affecting versions 46.0.0 through 48.0.5 as well as version 49.0.0 up to but not including 49.0.3. This flaw is rooted in the asynchronous execution model provided by the TypedFunc::call_async interface, which allows host applications to invoke WebAssembly functions asynchronously and manage their lifecycle via futures. The vulnerability manifests when a host application drops or cancels the future returned by this call before the guest task has actually begun execution. In such scenarios, the runtime's cleanup logic attempts to locate pending work items associated with that specific invocation but fails to find them in the expected location because the task had not yet been scheduled into the internal queue.
The core technical flaw lies in the error handling mechanism within this cleanup path. Instead of gracefully handling the absence of a corresponding work item, the code performs an unwrap operation on the result of its search. Since no item is found, the lookup returns an error state which, when unwrapped without proper conditional checking or alternative fallback logic, triggers a panic in the Rust runtime. This panic propagates up to the host environment, causing the entire process hosting the Wasmtime instance to crash abruptly. This behavior effectively allows any untrusted WebAssembly module that can trigger asynchronous calls followed by immediate cancellation from the host side to cause a denial of service against the embedding application.
From an operational perspective, this vulnerability poses significant risks for services relying on Wasmtime for sandboxed execution of user-supplied code, such as serverless platforms, web assembly gateways, or plugin systems. An attacker who can influence the timing and cancellation patterns of asynchronous calls could systematically crash these services by inducing repeated panics. This leads to service unavailability and potential data loss if state is not persisted outside the volatile memory space affected by the crash. The impact aligns with CWE-248, which describes unrecoverable errors in system or application states that lead to denial of service conditions due to improper exception handling or error recovery mechanisms.
To mitigate this risk, organizations running vulnerable versions of Wasmtime must upgrade immediately to version 49.0.6 or later for the 49.x branch and version 48.0.6 or later for the 48.x branch where these patches are available. Developers integrating Wasmtime into their applications should also review their codebases for any patterns involving TypedFunc::call_async to ensure robust error handling is implemented, although upgrading remains the primary remediation step as the fix addresses the root cause within the runtime itself rather than requiring changes in consumer code. Monitoring logs for panic traces can help identify if an exploitation attempt has occurred prior to patching. This incident highlights the importance of rigorous input validation and safe unwrapping practices even when dealing with internal state management during asynchronous task lifecycle events, a principle often referenced in secure coding guidelines related to resource cleanup and exception safety.