Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-27572 · Microsoft / collected KEV context

EUVD-2026-8569

GHSA-243v-98vx-264h

RUSTSEC-2026-0021

cve-program · CVE-2026-27572

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
• https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a
• https://docs.rs/http/1.4.0/http/header/#limitations
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4
• https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4

euvd · EUVD-2026-8569

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
• https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a
• https://docs.rs/http/1.4.0/http/header/#limitations
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4
• https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4

nvd · CVE-2026-27572

• https://docs.rs/http/1.4.0/http/header/#limitations
• https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4
• https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h

osv · GHSA-243v-98vx-264h

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
• https://nvd.nist.gov/vuln/detail/CVE-2026-27572
• https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a
• https://docs.rs/http/1.4.0/http/header/#limitations
• https://github.com/bytecodealliance/wasmtime
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6
• https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4
• https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4
• https://rustsec.org/advisories/RUSTSEC-2026-0021.html

osv · RUSTSEC-2026-0021

• https://crates.io/crates/wasmtime
• https://rustsec.org/advisories/RUSTSEC-2026-0021.html
• https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a

No related operational record is retained in the current change model.