Description
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
bytecodealliance wasmtime
Default version status: unaffected
0 to < 36.0.16affected36.0.16unaffected37.0.0 to < 48.0.3affected48.0.3unaffected49.0.0 to < 49.0.1affected49.0.1unaffected
pkg:cargo/wasmtime