CVE-2026-27572
highpriority · track · 30EPSS 0.005 · 44 %ileEUUSEPSS · scored 2026-10-27
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.6–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (13)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-243v-98vx-264hWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance2026-02-24ghsa · osvUS
### Impact Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. ### Patches Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. ### Workarounds There are no known workarounds at this time, embedders are encouraged to update to a patched version of Wasmtime. ### Resources * [Limitations of `http::HeaderMap`](https://docs.rs/http/1.4.0/http/header/#limitations)
- RUSTSEC-2026-0021Panic adding excessive fields to a `wasi:http/types.fields` instance2026-02-24vendor · osvUS
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h For more information see the GitHub-hosted security advisory.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (22)
External citations — patches, advisories, analysis.
- https://docs.rs/cnnvd
- https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0acnnvd
- https://github.com/bytecodealliance/wasmtime/releasesPatchcnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6cnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6cnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4cnnvd
- https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4cnnvd
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264hcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan