PT-2026-21805 · Bytecode Alliance · Wasmtime

Mbund · Published 2026-01-01 · Updated 2026-02-25 · CVE-2026-27204

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 24.0.6 Wasmtime versions prior to 36.0.6 Wasmtime versions prior to 40.0.4 Wasmtime versions prior to 41.0.4 Wasmtime versions prior to 42.0.0

Description Wasmtime's implementation of WASI host interfaces is susceptible to guest-controlled resource exhaustion on the host. The runtime did not appropriately limit resource allocations requested by guests, creating a Denial of Service vector. A guest can induce crashing behaviors on the host, such as allocating large amounts of memory, causing allocation failures, or triggering panics. The issue affects WASIp1 and WASIp2, as well as any Component Model (or WIT) based host API operating on string or list<T> types. The issue can lead to arbitrary amounts of host memory being allocated, and the guest can force the host to buffer arbitrary amounts of data.

Recommendations Upgrade to Wasmtime version 24.0.6 or later. Upgrade to Wasmtime version 36.0.6 or later. Upgrade to Wasmtime version 40.0.4 or later. Upgrade to Wasmtime version 41.0.4 or later. Upgrade to Wasmtime version 42.0.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-789

CWE-774

CWE-770

CWE-400

Related Identifiers

CVE-2026-27204

GHSA-852M-CVVP-9P4W

RUSTSEC-2026-0020

Affected Products

Wasmtime

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27204.json · Exploit
• https://ubuntu.com/security/CVE-2026-27204 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27204 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27204 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27204 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0020 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-852m-cvvp-9p4w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27204 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-27204 · Security Note
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/bytecodealliance/wasmtime/issues/11552 · Note
• https://github.com/bytecodealliance/wasmtime/pull/12599 · Note
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-852m-cvvp-9p4w · Note
• https://twitter.com/_cvereports/status/2026464121403617622 · Twitter Post