CVE-2026-27572: Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
(updated )
Wasmtime’s implementation of the wasi:http/types.fields resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime’s implementation in the wasmtime-wasi-http crate is backed by a data structure which panics when it reaches excessive capacity and this condition was not handled gracefully in Wasmtime. Panicking in a WASI implementation is a Denial of Service vector for embedders and is treated as a security vulnerability in Wasmtime.
References
- docs.rs/http/1.4.0/http/header/
- github.com/advisories/GHSA-243v-98vx-264h
- github.com/bytecodealliance/wasmtime
- github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0a
- github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6
- github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6
- github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4
- github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
- nvd.nist.gov/vuln/detail/CVE-2026-27572
- rustsec.org/advisories/RUSTSEC-2026-0021.html
Code Behaviors & Features
Detect and mitigate CVE-2026-27572 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →