CVE-2026-115390

Name	CVE-2026-115390
Description	Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-wasmtime (PTS)	trixie	26.0.1+dfsg-3	fixed
	forky, sid	36.0.13+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-wasmtime	source	(unstable)	(not affected)

Notes

- rust-wasmtime <not-affected> (Only affects 47 and later)
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x
https://rustsec.org/advisories/RUSTSEC-2026-0315.html
https://github.com/bytecodealliance/wasmtime/pull/14407