CVE-2026-115390
Description
A flaw was found in Wasmtime. This vulnerability allows an untrusted guest program to cause a Denial of Service (DoS) by bypassing execution limits. Due to an accounting flaw in Cranelift-compiled execution paths, a guest can reset consumed execution units (known as fuel) after specific function calls. Consequently, the guest module can run far longer than allocated, evading timeouts and exhausting host computing resources.
Statement
This vulnerability is rated as having a Moderate severity for Red Hat products because exploitation only results in a denial of service via excessive host CPU consumption, with no risk to system integrity or data confidentiality. In Red Hat environments, Wasmtime is embedded within specialized service shims or build tooling rather than arbitrary multi-tenant execution runtimes. Exploitation requires an attacker to supply and execute custom WebAssembly modules within instances configured specifically to meter execution using fuel units. Systems executing trusted code or leveraging OS-level resource limits like cgroups remain protected against broader service disruption.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.7 | N/A | 5.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
