Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Summary
Wasmtime can panic when adding excessive fields to a wasi:http/types.fields instance
Original description
The description as published by the source.
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the wasi:http/types.fields resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the wasmtime-wasi-http crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-27572 rust-wasmtime
- Ubuntu UBUNTU-CVE-2026-27572 rust-wasmtime
References
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package crates.io
- patch github.com
- web docs.rs
- web github.com
- web github.com
- web github.com
- web github.com