CVE-2026-27572
Denial of Service via Header Overflow in Wasmtime wasi:http
Publication date: 2026-02-24
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bytecodealliance | wasmtime | to 24.0.6 (exc) |
| bytecodealliance | wasmtime | From 25.0.0 (inc) to 36.0.6 (exc) |
| bytecodealliance | wasmtime | From 37.0.0 (inc) to 40.0.4 (exc) |
| bytecodealliance | wasmtime | From 41.0.0 (inc) to 41.0.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Wasmtime, a runtime for WebAssembly, specifically in its implementation of the `wasi:http/types.fields` resource. When too many header fields are added, the underlying data structure in the `wasmtime-wasi-http` crate panics due to excessive capacity. This panic is not handled gracefully, causing the runtime to crash. Such panics in a WASI implementation can lead to a Denial of Service (DoS) condition for applications embedding Wasmtime.
The issue is fixed in Wasmtime versions 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0, where the runtime returns a trap to the guest instead of panicking. There are currently no known workarounds, so users are encouraged to update to a patched version.
How can this vulnerability impact me? :
This vulnerability can cause Wasmtime to panic and crash when processing too many HTTP header fields, leading to a Denial of Service (DoS) for applications that rely on Wasmtime for WebAssembly execution. This means that an attacker could potentially disrupt the availability of services or applications embedding Wasmtime by triggering this condition.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Wasmtime to one of the patched versions: 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0.
There are no known workarounds at this time, so upgrading to a fixed version is the recommended immediate action.