Description
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
bytecodealliance wasmtime
Default version status: unaffected
0 to < 36.0.17affected36.0.17unaffected37.0.0 to < 48.0.4affected48.0.4unaffected49.0.0 to < 49.0.2affected49.0.2unaffected
pkg:cargo/wasmtime-wasi