Medium
5.9
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a...
CVE-2026-119132
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| bytecodealliance | wasmtime |
≥ 49.0.0, < 49.0.3 |
49.0.3 |
Original description The description as published by the source.
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com