CVE-2026-119142— Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

Quick assessment

Affected

bytecodealliance wasmtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wasmtime 46.0.0 至 48.0.6（不含）以及 49.0.0 至 49.0.3（不含）版本中存在一个拒绝服务（DoS）漏洞。当取消返回的时，若 guest 任务尚未启动，清理代码仅会在一个位置搜索工作项，并对返回的错误执行操作，从而导致取消待处理调用的宿主环境发生崩溃。

CVSS 4.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

Source: CVE Program / CVE List V5

Vulnerability Description

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可达断言

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasmtime	46.0.0 ~ 48.0.6	-

II. Public POCs for CVE-2026-119142

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119142

请登录查看更多情报信息。

Other References for CVE-2026-119142 (2)

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-call-async-drop third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119142

Same Patch Batch · bytecodealliance · 2026-10-29 · 14 CVEs total

CVE-2026-119134	6.2 MEDIUM	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory G
CVE-2026-119137	5.3 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-119141	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-119131	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-119138	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
CVE-2026-119143	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-119136	4.8 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-119140	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-119132	4.8 MEDIUM	Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-119139	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
CVE-2026-119135	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatc
CVE-2026-119133	2.6 LOW	Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception
CVE-2026-119130	2.6 LOW	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Targe

IV. Related Vulnerabilities

Same product: wasmtime

Same vendor: bytecodealliance

Same weakness: CWE-617