CVE-2026-119134— Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Quick assessment

Affected

bytecodealliance wasmtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Wasmtime 36.0.18 之前、37.0.0 至 48.0.6 之前，以及 49.0.0 至 49.0.3 之前的版本中，组件模型（component-model）的资源句柄表（resource handle tables）仅针对每个组件实例进行限制，且未将句柄的分配计入任何 ResourceLimiter 或 StoreLimits。恶意客户端（guest）可通过反复调用并实例化子组件，多次突破单实例的句柄上限，从而导致宿主（host）内存无限制增长。

CVSS 6.2 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Source: CVE Program / CVE List V5

Vulnerability Description

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasmtime	0 ~ 36.0.18	-

II. Public POCs for CVE-2026-119134

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119134

请登录查看更多情报信息。

Other References for CVE-2026-119134 (2)

https://www.cve.org/CVERecord?id=CVE-2026-119134

Same Patch Batch · bytecodealliance · 2026-10-29 · 14 CVEs total

CVE-2026-119137	5.3 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-119141	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-119131	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-119142	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
CVE-2026-119138	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
CVE-2026-119143	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-119136	4.8 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-119140	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-119132	4.8 MEDIUM	Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-119139	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
CVE-2026-119135	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatc
CVE-2026-119133	2.6 LOW	Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception
CVE-2026-119130	2.6 LOW	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Targe

IV. Related Vulnerabilities

Same product: wasmtime

Same vendor: bytecodealliance

Same weakness: CWE-770