Bug 2559268 (CVE-2026-115382) - CVE-2026-115382 wasmtime: wasmtime: Denial of Service via zero timeout in HTTP request option
Summary: CVE-2026-115382 wasmtime: wasmtime: Denial of Service via zero timeout in HTT...
Keywords:
Status: NEW
Alias: CVE-2026-115382
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-22 19:53 UTC by OSIDB Bzimport
Modified: 2026-10-29 17:16 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-22 19:53:52 UTC 
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding.
Note You need to log in before you can comment on or make changes to this bug.