{"id":"EUVD-2026-113210","enisaUuid":"afe9c71e-236f-3e02-811f-2feadfa94fa7","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders.","datePublished":"Oct 29, 2026, 3:58:21 PM","dateUpdated":"Nov 4, 2026, 1:29:32 AM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-zero-length-stream-writes\n","aliases":"CVE-2026-119143\nGHSA-368p-492j-h227\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"cfd9f224-440a-3b2d-a298-b3a1779fb3bc","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"f399754e-d79b-3381-b000-7aff4889a844","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"enisaIdVendor":[{"id":"a4810f01-6aca-3b5d-988b-ad2a2c95369e","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"1f7e57a7-f72a-36bf-a599-8dc7ba1d2825","vulnerability":{"id":"GHSA-368p-492j-h227","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders.","datePublished":"Oct 29, 2026, 6:31:01 PM","dateUpdated":"Oct 29, 2026, 6:31:01 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119143\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-zero-length-stream-writes\n","enisa_id":"EUVD-2026-113210\n","aliases":"GHSA-368p-492j-h227\nCVE-2026-119143\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7b082a85-22f8-31be-b8eb-b4dbabb27d8d","vulnerability":{"id":"CVE-2026-119143","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders.","datePublished":"Oct 29, 2026, 3:58:21 PM","dateUpdated":"Nov 4, 2026, 1:29:32 AM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-zero-length-stream-writes\n","enisa_id":"EUVD-2026-113210\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"807473b6-daca-373c-8104-fd79d2411ba9","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"fa8d1d92-ba9c-3b3f-bcf4-a9408faf378d","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"vulnerabilityVendor":[{"id":"32d04191-a448-3e9a-963d-839c0c95ba61","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}