{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-06T00:32:36.396","vulnerabilities":[{"cve":{"id":"CVE-2026-27572","sourceIdentifier":"security-advisories@github.com","published":"2026-02-24T22:16:32.687","lastModified":"2026-02-25T15:36:36.380","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the `wasmtime-wasi-http` crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 patch this vulnerability and return a trap to the guest instead of panicking. There are no known workarounds at this time. Embedders are encouraged to update to a patched version of Wasmtime."},{"lang":"es","value":"Wasmtime es un entorno de ejecución para WebAssembly. Antes de las versiones 24.0.6, 36.0.6, 4.0.04, 41.0.4 y 42.0.0, la implementación de Wasmtime del recurso `wasi:http/types.fields` es susceptible a panics cuando se añaden demasiados campos al conjunto de cabeceras. La implementación de Wasmtime en el crate `wasmtime-wasi-http` está respaldada por una estructura de datos que entra en pánico cuando alcanza una capacidad excesiva. Esta condición no se manejó convenientemente en Wasmtime. Entrar en pánico en una implementación de WASI es un vector de denegación de servicio para los integradores y se trata como una vulnerabilidad de seguridad en Wasmtime. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4 y 42.0.0 aplican un parche a esta vulnerabilidad y devuelven una trampa al invitado en lugar de entrar en pánico. No hay soluciones alternativas conocidas en este momento. Se anima a los integradores a actualizar a una versión de Wasmtime con parche."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*","versionEndExcluding":"24.0.6","matchCriteriaId":"FAB7C7D9-433F-4046-932B-44456BB034A3"},{"vulnerable":true,"criteria":"cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*","versionStartIncluding":"25.0.0","versionEndExcluding":"36.0.6","matchCriteriaId":"4AF1D021-3AC7-419E-AD0B-5C5738DC51E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*","versionStartIncluding":"37.0.0","versionEndExcluding":"40.0.4","matchCriteriaId":"2DBCFCF3-5A70-4441-B73D-E1CE96B01BE7"},{"vulnerable":true,"criteria":"cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*","versionStartIncluding":"41.0.0","versionEndExcluding":"41.0.4","matchCriteriaId":"9BF3C16E-C1D8-468A-9F60-9F6F45DA98E3"}]}]}],"references":[{"url":"https://docs.rs/http/1.4.0/http/header/#limitations","source":"security-advisories@github.com","tags":["Not Applicable"]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}}]}