5.7Orta
CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
Açıklama
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
Zayıflık türü (CWE):
CWE-400
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| bytecodealliance | wasmtime | 47.0.0 – < 48.0.3, fixed 48.0.3, 49.0.0 – < 49.0.1, fixed 49.0.1 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-m63x-6p34-q65x) vendor-advisory
- VulnCheck Advisory: Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS third-party-advisory