CVE-2026-119140
Medium · 4.8CVSS
4.8
EPSS
0.2%
Published
Oct 29, 2026
CISA due date
—
The record
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-41388 OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup… CWE-372
- CVE-2026-41340 OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where… CWE-372
- CVE-2026-41300 OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves… CWE-372