Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…smtime/security/advisories/GHSA-5hhx-4wrr-3j9g Üretici bülteni
• vulncheck.com/….0.0-before-49.0.3-host-panic-via-thread-yield Üçüncü taraf

Kayıt geçmişi

1. 29 Eki 2026 18:58Yayımlandı

İlgili açıklar

• 4,8 CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
• 4,8 CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
• 5,3 CVE-2026-119141Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
• 4,8 CVE-2026-119139Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
• 4,8 CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
• 5,3 CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry