CVE-2026-27572
📋 TL;DR
This vulnerability in Wasmtime's WASI HTTP implementation causes denial of service when excessive HTTP headers are processed. The runtime panics instead of gracefully handling the condition, allowing attackers to crash applications using vulnerable Wasmtime versions. All embedders using affected Wasmtime versions are impacted.
💻 Affected Systems
- Wasmtime WebAssembly runtime
📦 What is this software?
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to sustained denial of service, potentially affecting multiple services if Wasmtime is used in critical infrastructure.
Likely Case
Service disruption through application crashes when malicious HTTP requests with excessive headers are received.
If Mitigated
Minimal impact with proper monitoring and rapid incident response to restart services.
🎯 Exploit Status
Exploitation requires sending HTTP requests with excessive headers to trigger the panic condition. No authentication needed if HTTP endpoints are exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0
Vendor Advisory: https://github.com/bytecodealliance/wasmtime/security/advisories
Restart Required: Yes
Instructions:
1. Identify current Wasmtime version. 2. Update to patched version using package manager or direct download. 3. Restart all applications using Wasmtime. 4. Verify the update was successful.
🔧 Temporary Workarounds
No known workarounds
allThe vendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Implement rate limiting and request filtering to block HTTP requests with excessive headers
- Deploy monitoring and automated restart mechanisms to detect and recover from crashes
🔍 How to Verify
Check if Vulnerable:
Check Wasmtime version with 'wasmtime --version' and compare against affected versionsCheck Version:
wasmtime --versionVerify Fix Applied:
Verify version is 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0 or higher📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning Wasmtime panic
- Error logs related to HTTP header processing failures
- Sudden service termination without normal shutdown
Network Indicators:
- HTTP requests with abnormally large number of headers
- Repeated connection attempts to HTTP endpoints
SIEM Query:
source="application.logs" AND ("panic" OR "wasmtime" OR "wasi:http") AND ("crash" OR "terminated")🔗 References
- https://docs.rs/http/1.4.0/http/header/#limitations
- https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a
- https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6
- https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4
- https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
