Denial of Service

Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.

1. Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instanceCVE-2026-27572bytecodealliance · CVSS 6.9 · 0.5% likely

   CWE-770

2. `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosionCVE-2024-43806bytecodealliance · CVSS 6.5 · 0.5% likely

   CWE-400

3. Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionCVE-2026-27204bytecodealliance · CVSS 6.9 · 0.4% likely

   CWE-774

4. Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type RegistryCVE-2026-119137bytecodealliance · CVSS 5.3 · 0.4% likely

   CWE-674

5. Wasmtime: Leak in WASIp1 `fd_renumber` implementationCVE-2026-54786bytecodealliance · CVSS 2.3 · 0.4% likely

   CWE-772

6. Wasmtime: Panic when allocating a table exceeding the size of the host's address spaceCVE-2026-44216bytecodealliance · CVSS 7.5 · 0.3% likely

   CWE-770

7. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async DropCVE-2026-119142bytecodealliance · CVSS 4.8 · 0.3% likely

   CWE-617

8. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After TrapCVE-2026-119138bytecodealliance · CVSS 4.8 · 0.3% likely

   CWE-617

9. Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoSCVE-2026-115390bytecodealliance · CVSS 5.7 · 0.2% likely

   CWE-400

10. Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backendCVE-2026-35186bytecodealliance · CVSS 7.5 · 0.2% likely

    CWE-789

11. Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused AdapterCVE-2026-119132bytecodealliance · CVSS 4.8 · 0.2% likely

    CWE-617

12. Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroesCVE-2026-115381bytecodealliance · CVSS 4.8 · 0.2% likely

    CWE-770

13. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callCVE-2026-119139bytecodealliance · CVSS 4.8 · 0.2% likely

    CWE-617

14. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type MismatchCVE-2026-119135bytecodealliance · CVSS 4.8 · 0.2% likely

    CWE-617

15. Wasmtime has memory leak in C API with `externref` and `anyref` typesCVE-2025-61670bytecodealliance · CVSS 1 · 0.2% likely

    CWE-772

16. Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 StreamsCVE-2026-115391bytecodealliance · CVSS 5.8 · 0.2% likely

    CWE-770

17. Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource HandlesCVE-2026-119134bytecodealliance · CVSS 6.2 · 0.2% likely

    CWE-770

18. Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APICVE-2026-115389bytecodealliance · CVSS 2.3 · 0.2% likely

    CWE-770

19. Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffCVE-2026-115380bytecodealliance · CVSS 4 · 0.1% likely

    CWE-770

20. Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body WriteCVE-2026-115388bytecodealliance · CVSS 6.2 · 0.1% likely

    CWE-400

21. Wasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check PanicCVE-2026-126408bytecodealliance · CVSS 1.8

    CWE-617

22. Wasmtime before 36.0.20 Denial of Service via Borrowed Resource TransferCVE-2026-126407bytecodealliance · CVSS 4.8

    CWE-770

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.