CVE-2026-27572
highPriorität · verfolgen · 30EPSS 0.005 · 44. PerzentilEUUSEPSS · bewertet 2026-10-27
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 3.6–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (13)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-243v-98vx-264hWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance2026-02-24ghsa · osvUS
### Impact Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. ### Patches Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. ### Workarounds There are no known workarounds at this time, embedders are encouraged to update to a patched version of Wasmtime. ### Resources * [Limitations of `http::HeaderMap`](https://docs.rs/http/1.4.0/http/header/#limitations)
- RUSTSEC-2026-0021Panic adding excessive fields to a `wasi:http/types.fields` instance2026-02-24vendor · osvUS
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h For more information see the GitHub-hosted security advisory.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (22)
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.rs/cnnvd
- https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0acnnvd
- https://github.com/bytecodealliance/wasmtime/releasesPatchcnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6cnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6cnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4cnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4cnnvd
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264hcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan