CVE-2026-44216: Bytecode Alliance Wasmtime denial of service via table allocation panic

CVE-2026-44216 · Severity: high · CVSS 7.5 · Published 2026-05-14

Wasmtime is a runtime used to execute WebAssembly code, often used to run untrusted code safely in isolated environments. A flaw in how it handles memory allocation for very large data tables can cause the entire host application to crash. This allows a user with the ability to provide WebAssembly modules to trigger a denial-of-service, potentially disrupting services or applications relying on the runtime.

Technologies: wasmtime (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-44216 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44216 being exploited in the wild.
How severe is CVE-2026-44216?
High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?
wasmtime (crates.io) SEMVER:introduced=30.0.0,fixed=36.0.8, SEMVER:introduced=30.0.0,fixed=36.0.8,introduced=37.0.0,fixed=43.0.2,introduced=44.0.0,fixed=44.0.1.
Is there a fix for CVE-2026-44216?
Yes. wasmtime (crates.io): upgrade to 36.0.8, 44.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44216 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44216?
Check whether you run wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • wasmtime (crates.io): upgrade to 36.0.8, 44.0.1 or later
    cargo update -p wasmtime

Technical details

Wasmtime's on-demand instance allocator contains a vulnerability in its table allocation logic where checked arithmetic can result in a panic upon overflow. This is specifically exploitable when the 'memory64' WebAssembly proposal is enabled (which is the default), as it allows for 64-bit table sizes that can exceed the host's address space and trigger the overflow. An attacker who can provide a malicious WebAssembly module or component can trigger this panic during instantiation, leading to a denial-of-service of the host process. The pooling allocator is not affected as it enforces stricter limits on table sizes. The issue is resolved in versions 36.0.8, 43.0.2, and 44.0.1.

Affected products

  • Bytecode Alliance Wasmtime 30.0.0 to 36.0.7, 37.0.0 to 43.0.1, 44.0.0

Identifiers

  • CVE-2026-44216
  • GHSA-p8xm-42r7-89xg
  • RUSTSEC-2026-0114

Timeline

  • 2026-04-30: advisory: GitHub advisory published by maintainers
  • 2026-05-14: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.