PT-2026-21806 · Bytecode Alliance · Wasmtime

Alexcrichton · Published 2026-01-01 · Updated 2026-02-25 · CVE-2026-27572

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 24.0.6 Wasmtime versions prior to 36.0.6 Wasmtime version 4.0.04 Wasmtime versions prior to 41.0.4 Wasmtime versions prior to 42.0.0

Description Wasmtime's implementation of the wasi:http/types.fields resource is susceptible to panics when an excessive number of fields are added to the set of headers. The wasmtime-wasi-http crate uses a data structure that panics when it reaches its capacity, and this condition was not handled gracefully. A panic in a WASI implementation can lead to a Denial of Service for embedders.

Recommendations Update to Wasmtime version 24.0.6 or later. Update to Wasmtime version 36.0.6 or later. Update to Wasmtime version 4.0.04 or later. Update to Wasmtime version 41.0.4 or later. Update to Wasmtime version 42.0.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-27572

GHSA-243V-98VX-264H

RUSTSEC-2026-0021

Affected Products

Wasmtime

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27572.json · Exploit
• https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a · Patch
• https://cve.org/CVERecord?id=CVE-2026-27572 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-27572 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-243v-98vx-264h · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27572 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27572 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27572 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h · Note
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6 · Note
• https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4 · Note