{"id":"EUVD-2026-113204","enisaUuid":"32c1424e-c30c-363d-b578-e8e20b0818b4","description":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.","datePublished":"Oct 29, 2026, 3:58:17 PM","dateUpdated":"Oct 29, 2026, 5:14:32 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr\nhttps://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-stack-overflow-via-type-registry\n","aliases":"CVE-2026-119137\nGHSA-42v6-vp8p-fcjx\n","assigner":"VulnCheck","epss":0.0,"enisaIdProduct":[{"id":"6d275717-78df-3601-8e5d-8821f2ff3503","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"d75687f8-51b9-3b5c-a773-5d057f3ca39f","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"42.0.0 \u003c48.0.6"}],"enisaIdVendor":[{"id":"f5afda7b-fe3d-33de-a8fd-72297ab89adf","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"22899e81-9308-34d1-bd2f-a7f1b44f401a","vulnerability":{"id":"GHSA-42v6-vp8p-fcjx","description":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.","datePublished":"Oct 29, 2026, 6:31:00 PM","dateUpdated":"Oct 29, 2026, 6:31:00 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119137\nhttps://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-stack-overflow-via-type-registry\n","enisa_id":"EUVD-2026-113204\n","aliases":"CVE-2026-119137\nGHSA-42v6-vp8p-fcjx\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 5:00:57 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"54fcc7b8-8468-3bb5-b2d8-a903eae53aac","vulnerability":{"id":"CVE-2026-119137","description":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.","datePublished":"Oct 29, 2026, 3:58:17 PM","dateUpdated":"Oct 29, 2026, 5:14:32 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr\nhttps://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-stack-overflow-via-type-registry\n","enisa_id":"EUVD-2026-113204\n","assigner":"VulnCheck","epss":0.0,"dataProcessed":"Oct 30, 2026, 5:00:40 AM","vulnerabilityProduct":[{"id":"291a52ce-ce9f-30c3-8444-fa120f866f29","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"a6946264-10db-34a1-8f0d-d679559585d7","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"42.0.0 \u003c48.0.6"}],"vulnerabilityVendor":[{"id":"4e6e49b4-5f36-3e91-bc46-76d3fcf23019","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}