CVE-2026-126407
Deferred Deferred - Pending Action

Memory Exhaustion in Wasmtime Due to Untracked Host Memory Allocation

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126407
EUVD
EUVD-2026-125036

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wasmtime wasmtime to 36.0.20 (exc)
wasmtime wasmtime From 37.0.0 (exc) to 48.0.8 (exc)
wasmtime wasmtime From 49.0.0 (exc) to 49.0.5 (exc)
wasmtime wasmtime From 50.0.0 (exc) to 50.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Wasmtime versions before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 have a flaw where untracked host memory is allocated when a component receives a borrow of a resource it defines itself. This bypasses the per-store handle limit, allowing a malicious guest component to repeatedly transfer borrowed resources and consume arbitrary host memory, leading to denial of service.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive host memory, potentially crashing systems or applications relying on Wasmtime. It may lead to degraded performance, system instability, or unavailability of services if exploited by a malicious component.

Mitigation Strategies

Update Wasmtime to a patched version: 36.0.20, 48.0.8, 49.0.5, or 50.0.1 or later to address the memory allocation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126407. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...