PT-2026-38398 · Bytecode Alliance · Wasmtime

Alexcrichton · Published 2026-04-30 · Updated 2026-06-01 · CVE-2026-44216

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.8 Wasmtime versions prior to 43.0.2 Wasmtime versions prior to 44.0.1

Description Allocation logic for a WebAssembly table contains checked arithmetic that panics on overflow when a table with an extremely large size is allocated. This occurs during the instantiation of a WebAssembly module or component and is possible when the memory64 WebAssembly feature is enabled, allowing table sizes in the 64-bit range. The issue specifically affects the on-demand instance allocator, which is the default allocator, and can lead to a denial-of-service by causing the host process to panic.

Recommendations Update to version 36.0.8. Update to version 43.0.2. Update to version 44.0.1. Switch to using the pooling allocator. Disable the memory64 WebAssembly proposal.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-44216

GHSA-P8XM-42R7-89XG

OPENSUSE-SU-2026:10802-1

RUSTSEC-2026-0114

SUSE-SU-2026:22002-1

Affected Products

Wasmtime

References · 17

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44216 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2026-0114 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44216 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10802-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44216 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8xm-42r7-89xg · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44216 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44216 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44216 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22002-1 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://suse.com/support/update/announcement/2026/suse-su-202622002-1 · Note
• https://bugzilla.suse.com/1265300 · Note
• https://crates.io/crates/wasmtime · Note