{"id":"EUVD-2026-8569","enisaUuid":"6301b41f-5d03-3ff7-addd-95abe61fa759","description":"Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime\u0027s implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime\u0027s implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.","datePublished":"Feb 24, 2026, 9:31:50 PM","dateUpdated":"Feb 27, 2026, 8:55:29 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h\nhttps://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a\nhttps://docs.rs/http/1.4.0/http/header/#limitations\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4\n","aliases":"CVE-2026-27572\nGHSA-243v-98vx-264h\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"50c08618-3f65-3b92-8920-8c27819e105e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 24.0.6"},{"id":"682c0ba7-5265-3382-b1f7-19d63d74a6fc","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.6"},{"id":"6eee6970-5e69-3253-9125-be547c097976","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"41.0.0, \u003c 41.0.4"},{"id":"983010d0-6499-3381-abf5-26a7ba369c95","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 40.0.4"}],"enisaIdVendor":[{"id":"0ad21f65-0722-3501-afa1-9c86b41ce169","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"61a0d12b-5910-347c-9c73-cd60ca863786","vulnerability":{"id":"GHSA-243v-98vx-264h","description":"Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance","datePublished":"Feb 24, 2026, 9:08:06 PM","dateUpdated":"Feb 27, 2026, 8:25:44 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27572\nhttps://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a\nhttps://docs.rs/http/1.4.0/http/header/#limitations\nhttps://github.com/bytecodealliance/wasmtime\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4\nhttps://rustsec.org/advisories/RUSTSEC-2026-0021.html\n","enisa_id":"EUVD-2026-8569\n","aliases":"CVE-2026-27572\nGHSA-243v-98vx-264h\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:18 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a84b4432-2427-3911-a19b-1f0e3cd8c93e","vulnerability":{"id":"CVE-2026-27572","description":"Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime\u0027s implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime\u0027s implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime.","datePublished":"Feb 24, 2026, 9:31:50 PM","dateUpdated":"Feb 27, 2026, 8:55:29 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h\nhttps://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a\nhttps://docs.rs/http/1.4.0/http/header/#limitations\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4\n","enisa_id":"EUVD-2026-8569\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Nov 5, 2026, 7:17:35 AM","vulnerabilityProduct":[{"id":"40645a0c-ba33-37b3-8be2-94fab8214cc2","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 24.0.6"},{"id":"89f71604-18fc-396e-87e0-6ad980d7cc40","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"41.0.0, \u003c 41.0.4"},{"id":"8ac611c8-181d-36bd-b619-055a57145a7b","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.6"},{"id":"de2cb196-aea9-3b1e-911f-40f1e3ee7e8d","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 40.0.4"}],"vulnerabilityVendor":[{"id":"12e3ef63-32d6-3eda-8092-9c8d86e271b0","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}