Veille CVE

Vendredi 23 octobre 2026

3 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « bytecodealliance wasmtime » ✕
  1. CVE-2026-115390 5.7 Moyenne

    bytecodealliance wasmtime

    Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.

  2. CVE-2026-115386 2.6 Faible

    bytecodealliance wasmtime

    Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.

  3. CVE-2026-115382 4.8 Moyenne

    bytecodealliance wasmtime

    Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.