{"id":"EUVD-2026-113205","enisaUuid":"b8ae0e02-81cc-3a2a-9f3a-a17d08cddaf8","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.","datePublished":"Oct 29, 2026, 3:58:18 PM","dateUpdated":"Oct 29, 2026, 8:13:38 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-after-trap\n","aliases":"CVE-2026-119138\nGHSA-5vwq-v85g-fcqv\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"8e5725f1-d1a9-33d4-b9af-7452cbabbe38","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"a8e8c19d-9806-3209-b3bb-c2c0700856bb","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"enisaIdVendor":[{"id":"f5e470c6-64d9-3aab-8186-ee4168413946","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"310f16a1-715d-3fa7-9db8-0bf2b48bbaaa","vulnerability":{"id":"CVE-2026-119138","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.","datePublished":"Oct 29, 2026, 3:58:18 PM","dateUpdated":"Oct 29, 2026, 8:13:38 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-after-trap\n","enisa_id":"EUVD-2026-113205\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Nov 2, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"681bd06a-8990-3d02-8db0-42c8a09414c6","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"},{"id":"9181ecc1-bd4b-3877-a69f-8fd7cebea881","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"vulnerabilityVendor":[{"id":"adda74f6-84eb-3302-b98b-ec8a17d0a27a","vendor":{"name":"bytecodealliance"}}]}},{"id":"f2ae87f8-87f4-3627-bae3-52a1175789c1","vulnerability":{"id":"GHSA-5vwq-v85g-fcqv","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.","datePublished":"Oct 29, 2026, 6:31:00 PM","dateUpdated":"Oct 29, 2026, 6:31:00 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119138\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-after-trap\n","enisa_id":"EUVD-2026-113205\n","aliases":"CVE-2026-119138\nGHSA-5vwq-v85g-fcqv\n","epss":0.0,"dataProcessed":"Nov 2, 2026, 7:03:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}