{"id":"EUVD-2026-113201","enisaUuid":"2ae2f543-4b24-3945-9a52-a6c1799719c7","description":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.","datePublished":"Oct 29, 2026, 3:58:15 PM","dateUpdated":"Oct 29, 2026, 8:14:16 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p\nhttps://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-unbounded-memory-growth-via-component-model-resource-handles\n","aliases":"CVE-2026-119134\nGHSA-59gg-q3p6-vwvr\n","assigner":"VulnCheck","epss":0.15,"enisaIdProduct":[{"id":"4402893c-5487-37f0-bf07-a348255cee0c","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"0 \u003c36.0.18"},{"id":"4f2ea453-cabc-35c8-b217-ed7b083e126a","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0 \u003c48.0.6"},{"id":"f04288ca-642b-37d0-9cff-41c638dd4c83","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"enisaIdVendor":[{"id":"a9663545-491a-374b-bc93-237e5190ea9f","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"a06c1312-7909-3f95-97c4-a3f8018281e8","vulnerability":{"id":"CVE-2026-119134","description":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.","datePublished":"Oct 29, 2026, 3:58:15 PM","dateUpdated":"Oct 29, 2026, 8:14:16 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p\nhttps://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-unbounded-memory-growth-via-component-model-resource-handles\n","enisa_id":"EUVD-2026-113201\n","assigner":"VulnCheck","epss":0.15,"dataProcessed":"Nov 1, 2026, 4:04:21 AM","vulnerabilityProduct":[{"id":"061931c0-3f7b-3766-bab2-b65a82c92a81","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"6fb444ab-aabe-3da2-b779-73eb43cd077a","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"0 \u003c36.0.18"},{"id":"e4a60ffb-436a-30c1-ad37-12bf34a08cb4","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0 \u003c48.0.6"}],"vulnerabilityVendor":[{"id":"e37809f1-d517-33e2-8775-a34aa4600148","vendor":{"name":"bytecodealliance"}}]}},{"id":"ec86b39a-98d2-33c3-8b5e-3e0fb2c3fbc1","vulnerability":{"id":"GHSA-59gg-q3p6-vwvr","description":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.","datePublished":"Oct 29, 2026, 6:30:59 PM","dateUpdated":"Oct 29, 2026, 6:30:59 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119134\nhttps://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-unbounded-memory-growth-via-component-model-resource-handles\n","enisa_id":"EUVD-2026-113201\n","aliases":"CVE-2026-119134\nGHSA-59gg-q3p6-vwvr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:09:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}