CVE-2026-27204 — Uncontrolled Resource Consumption in Wasmtime

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-774 — Allocation of File Descriptors or Handles Without Limits or ThrottlingCWE-789 — Memory Allocation with Excessive Size Value8 documents6 sources
Severity
6.9MEDIUMNVD
EPSS
0.1%
top 76.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Bytecodealliance WasmtimeDebian Rust-wasmtime
Timeline
PublishedFeb 24

Description

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested by the guests. This serves as a Denial of Service vector. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 have all been released with the fix for this issue. These versions do not prevent this issue…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Affected Packages4 packages

▶debiandebian/rust-wasmtime< rust-wasmtime 36.0.6+dfsg-1 (forky)
▶NVDbytecodealliance/wasmtime25.0.0 — 36.0.6+3
▶crates.iobytecodealliance/wasmtime25.0.0 — 36.0.6+4
▶CVEListV5bytecodealliance/wasmtime>= 25.0.0, < 36.0.6, >= 37.0.0, < 40.0.4, >= 41.0.0, < 41.0.4+2

🔴Vulnerability Details

4
OSV
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion↗2026-02-24
▶
GHSA
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion↗2026-02-24
▶
OSV
CVE-2026-27204: Wasmtime is a runtime for WebAssembly↗2026-02-24
▶
OSV
Guest-controlled resource exhaustion in WASI implementations↗2026-02-24
▶

📋Vendor Advisories

2
Red Hat
wasmtime: Wasmtime: Denial of Service via guest-controlled resource exhaustion in WASI host interfaces↗2026-02-24
▶
Debian
CVE-2026-27204: rust-wasmtime - Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04,...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27204 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶