Loading...
Skip to main content
GeekWala

CVE-2026-27572 — Vulnerability in wasmtime — CVE Details

MEDIUM

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Published February 24, 2026Updated September 10, 2026Source: osv

Summary

### Impact Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. ### Patches Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. ### Workarounds There are no known workarounds at this time, embedders are encouraged to update to a patched version of Wasmtime. ### Resources * [Limitations of `http::HeaderMap`](https://docs.rs/http/1.4.0/http/header/#limitations)

Advisory Timeline

  • First published February 24, 2026 (230 days ago).
  • Last revised September 10, 2026 — 197 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update wasmtime to 36.0.6 or later
cargo update -p wasmtime --precise 36.0.6
Cargo
Update wasmtime to 40.0.4 or later
cargo update -p wasmtime --precise 40.0.4
Cargo
Update wasmtime to 24.0.6 or later
cargo update -p wasmtime --precise 24.0.6

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
wasmtime
crates.io
All versions36.0.6
wasmtime
crates.io
All versions40.0.4
wasmtime
crates.io
All versions24.0.6

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-770
    Allocation of Resources Without LimitsMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

Frequently Asked Questions

What is CVE-2026-27572?
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2026-27572?
CVE-2026-27572 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-27572 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-243v-98vx-264h
RUSTSEC-2026-0021

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies