CVE-2026-27572: Wasmtime Denial of Service Vulnerability Due to Excessive Header Fields
Summary
CVE-2026-27572: Wasmtime can panic when adding excessive fields to a wasi:http/types.fields instance. Affects wasmtime across 4 version ranges.
< 24.0.6
>= 25.0.0, < 36.0.6
>= 37.0.0, < 40.0.4
>= 41.0.0, < 41.0.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a runtime for WebAssembly that allows developers to run WebAssembly modules efficiently. It is designed to provide a secure and efficient environment for executing WebAssembly code, particularly in server-side applications. The package includes support for WASI (WebAssembly System Interface), which enables WebAssembly modules to interact with the host environment. However, a recent vulnerability has been identified in the wasi:http/types.fields implementation, which can lead to application crashes under specific conditions.
Vulnerability Detail
The vulnerability arises from Wasmtime's handling of excessive fields in the wasi:http/types.fields resource. When too many fields are added to the headers, the underlying data structure can exceed its capacity, resulting in a panic. This panic is not handled gracefully, leading to a Denial of Service (DoS) condition for applications embedding Wasmtime. Such behavior is particularly concerning as it can disrupt service availability and is classified as a security vulnerability.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 24.0.624.0.6 -
>= 25.0.0, < 36.0.636.0.6 -
>= 37.0.0, < 40.0.440.0.4 -
>= 41.0.0, < 41.0.441.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. It is strongly recommended that users upgrade to a patched version of Wasmtime to mitigate the risk.
Conclusion
In summary, the vulnerability identified as CVE-2026-27572 in Wasmtime poses a significant risk of Denial of Service due to excessive header fields. Users are advised to update to the latest patched versions to ensure the security and availability of their applications.
See every vulnerability recorded for wasmtime →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by excessive fields being added to the wasi:http/types.fields resource, leading to application panics.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any sign-up.
While there are no known workarounds, it is crucial to prioritize updating to a patched version to avoid potential service disruptions.
The patched versions of Wasmtime are 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
