CVE-2026-119137 bytecodealliance CVE debrief

Who should care

Defenders who use the Wasmtime library in their applications should be aware of this vulnerability and take steps to patch vulnerable installations. This includes developers and administrators who use Wasmtime in their software supply chain.

Why it matters

A stack overflow vulnerability was found in the Wasmtime library, which could potentially lead to a denial-of-service attack. Defenders should prioritize patching vulnerable Wasmtime installations to prevent potential attacks.

• Potential denial-of-service attacks against Wasmtime installations
• Need to verify version of Wasmtime installed and update to a fixed version if necessary
• Monitoring for potential exploitation attempts may be necessary

Technical summary

The vulnerability is caused by dropping a long chain of recursive types in the Wasmtime library. This could potentially lead to a stack overflow and a denial-of-service attack. The affected package is wasmtime, and the vulnerability has been fixed in versions 48.0.6 and 49.0.3. The issue arises from the library's handling of complex type structures, which can cause a stack overflow when a long chain of recursive types is encountered. Defenders should prioritize patching vulnerable Wasmtime installations to prevent potential denial-of-service attacks.

Defensive priority

Defenders should prioritize patching vulnerable Wasmtime installations to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch vulnerable Wasmtime installations to prevent potential denial-of-service attacks
• Verify the version of Wasmtime installed and update to a fixed version if necessary
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an unknown vendor and has a low confidence level. The evidence is based on a single source item from osv_dev. The source item provides details about the vulnerability, but the limited information available may not fully capture the scope or impact of the issue. Defenders should verify the version of Wasmtime installed and update to a fixed version if necessary, while also monitoring for potential exploitation attempts. Additional information from other sources may be necessary to fully understand the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.