CVE-2026-115390

The Wasmtime runtime (versions 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 ) is susceptible to a fuel accounting flaw within Cranelift-compiled call_ref and try_table catch paths . This vulnerability allows malicious guests to reset consumed fuel following specific calls, enabling them to execu...

CVE-2026-115390 Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled callref and trytable catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service...