CVE-2026-115892: Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Wasmtime may panic when the host lowers a component model stream or future into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as StreamAny or FutureAny, and then passes it to a guest function with a different payload type.
GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.
References
- github.com/advisories/GHSA-9pvw-hwfg-92h5
- github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
- github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158
- github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
- github.com/bytecodealliance/wasmtime/pull/14819
- github.com/bytecodealliance/wasmtime/pull/14820
- github.com/bytecodealliance/wasmtime/pull/14827
- github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7
- github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5
- nvd.nist.gov/vuln/detail/CVE-2026-115892
- rustsec.org/advisories/RUSTSEC-2026-0378.html
Code Behaviors & Features
Detect and mitigate CVE-2026-115892 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →