CVE-2026-115390

The record

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. CWE-400
• CVE-2026-62300 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP… CWE-400
• CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. CWE-400
• CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-400
• CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-400
• CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-400
• CVE-2026-61848 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-400
• CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. CWE-400