CVE-2026-119134

Name	CVE-2026-119134
Description	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151861

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-wasmtime (PTS)	trixie	26.0.1+dfsg-3	vulnerable
	forky, sid	36.0.13+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-wasmtime	source	(unstable)	(unfixed)			1151861

Notes

https://rustsec.org/advisories/RUSTSEC-2026-0363.html
https://github.com/advisories/GHSA-q554-3cjc-rx7p
https://github.com/bytecodealliance/wasmtime/pull/14732