CVE-2026-27572
published 2026-02-24CVE-2026-27572: Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields`…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.47%
36.9th percentile
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | wasmtime | < 24.0.6 | 24.0.6 |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | >= 0 < 24.0.6 | 24.0.6 |
| bytecodealliance | wasmtime | >= 0.0.0-0 < 24.0.6 | 24.0.6 |
| bytecodealliance | wasmtime | >= 25.0.0 < 36.0.6 | 36.0.6 |
| bytecodealliance | wasmtime | >= 25.0.0 < 36.0.6 | 36.0.6 |
| bytecodealliance | wasmtime | >= 37.0.0 < 40.0.4 | 40.0.4 |
| bytecodealliance | wasmtime | >= 37.0.0 < 40.0.4 | 40.0.4 |
| bytecodealliance | wasmtime | >= 41.0.0 < 41.0.4 | 41.0.4 |
| bytecodealliance | wasmtime | >= 41.0.0 < 41.0.4 | 41.0.4 |
| debian | rust-wasmtime | < rust-wasmtime 36.0.6+dfsg-1 (forky) | rust-wasmtime 36.0.6+dfsg-1 (forky) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
ghsa·2026-02-24
CVE-2026-27572 [MEDIUM] CWE-770 Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
### Impact
Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime.
### Patches
Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking.
### Workarounds
There are no known workarounds at this time, embedders are e
OSV
CVE-2026-27572: Wasmtime is a runtime for WebAssembly
osv·2026-02-24·CVSS 6.9
CVE-2026-27572 [MEDIUM] CVE-2026-27572: Wasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patche
OSV
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
osv·2026-02-24
CVE-2026-27572 [MEDIUM] Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
### Impact
Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime.
### Patches
Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking.
### Workarounds
There are no known workarounds at this time, embedders are e
OSV
Panic adding excessive fields to a `wasi:http/types.fields` instance
osv·2026-02-24
CVE-2026-27572 Panic adding excessive fields to a `wasi:http/types.fields` instance
Panic adding excessive fields to a `wasi:http/types.fields` instance
This is an entry in the RustSec database for the Wasmtime security advisory
located at
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
For more information see the GitHub-hosted security advisory.
Red Hat
wasmtime: Wasmtime: Denial of Service via excessive HTTP header fields
vendor_redhat·2026-02-24·CVSS 6.9
CVE-2026-27572 [MEDIUM] CWE-770 wasmtime: Wasmtime: Denial of Service via excessive HTTP header fields
wasmtime: Wasmtime: Denial of Service via excessive HTTP header fields
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known
Debian
CVE-2026-27572: rust-wasmtime - Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04,...
vendor_debian·2026·CVSS 6.9
CVE-2026-27572 [MEDIUM] CVE-2026-27572: rust-wasmtime - Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04,...
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patche
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-27572 tree-sitter: Wasmtime: Denial of Service via excessive HTTP header fields [fedora-42]
bugzilla·2026-02-24·CVSS 6.9
CVE-2026-27572 [MEDIUM] CVE-2026-27572 tree-sitter: Wasmtime: Denial of Service via excessive HTTP header fields [fedora-42]
CVE-2026-27572 tree-sitter: Wasmtime: Denial of Service via excessive HTTP header fields [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained versi
Wiz
CVE-2026-27572 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.9
CVE-2026-27572 [MEDIUM] CVE-2026-27572 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27572 :
Rust vulnerability analysis and mitigation
wasi:http/types.fields
wasmtime-wasi-http
Source : NVD
## 6.9
Score
Published February 24, 2026
Severity MEDIUM
CNA Score 6.9
Affected Technologies
Rust
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
rust-wasmtime
wasmtime
Sources
NVD
Chainguard Has Fix Added at: Mar 02, 2026
Debian 13 Severity MEDIUM No Fix Added at: Feb 24, 2026
Debian 14 Severity HIGH Has Fix Added at: Feb 24, 2026
Echo Severity HIGH No Fix Added at: Feb 25, 2026
Rust Severity MEDIUM Has Fix Added at: Feb 25, 2026
Homebrew Severity HIGH Has Fix Added at: Mar 03,
https://docs.rs/http/1.4.0/http/header/#limitationshttps://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0ahttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
2026-02-24
Published