CVE-2026-119142

MediumCVSS 4.8/10Last modified Oct 29, 2026

Description

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
bytecodealliance	wasmtime	>= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3

References

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1191434.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host p CVE-2026-1191448.8Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled mes CVE-2026-1191459.9Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validat CVE-2026-1191465.6ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote CVE-2026-1191474.3ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE chec CVE-2026-1191486.5Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To CVE-2026-119155.9vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.CVE-2026-1191525.4The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scr CVE-2026-1191557.5The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and CVE-2026-1191567.2The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], w CVE-2026-1191587.2The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2026-1191606.4The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-S