CVE-2026-27195: 
Rust vulnerability analysis and mitigation

CVE-2026-27195 is a denial-of-service vulnerability in Bytecode Alliance's Wasmtime WebAssembly runtime, caused by a panic when a host embedder drops a [Typed]Func::call_async future without awaiting its completion and then reuses the same component instance. The vulnerability was introduced in Wasmtime 39.0.0 when the component-model-async feature became enabled by default, and was publicly disclosed on February 24, 2026. Affected versions are 39.0.0 through 40.0.3 and 41.0.0 through 41.0.3; versions 42.0.0 and later are unaffected. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-755 (Improper Handling of Exceptional Conditions). The bug resides in the component-model-async implementation of [Typed]Func::call_async in Wasmtime's component runtime (wasmtime/src/runtime/component/concurrent.rs). The panic is triggered by a specific sequence: (1) a host calls call_async on a component export and polls the returned Future once; (2) the component yields control to the async runtime (e.g., Tokio) via a yielding host function or epoch interruption; (3) the host drops the Future, leaving the component instance in a non-reenterable state; (4) the host calls call_async again on the same instance, which traps after allocating a task and thread; (5) the host drops this second Future, causing a panic during task cleanup because the associated thread has not yet exited. Embeddings that have the component-model-async Cargo feature disabled at compile time are not affected (GitHub Advisory).

Successful exploitation causes the Wasmtime runtime to panic, crashing the host application and resulting in a denial of service. The impact is purely an availability concern — there is no confidentiality or integrity compromise. Any service or application that uses Wasmtime with the component-model-async feature enabled, calls async-typed guest export functions via call_async, and drops the returned Future before completion (then reuses the component instance) is susceptible to an application crash and complete unavailability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.05% (24th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific sequence of async API misuse within the host embedding, making opportunistic exploitation unlikely without access to the host application's code or the ability to influence its async control flow (GitHub Advisory).

1. Identify a vulnerable target: Locate a service or application using Wasmtime versions 39.0.0–40.0.3 or 41.0.0–41.0.3 with the component-model-async feature enabled (default in these versions) that exposes async-typed component export functions.
2. Trigger an async yield: Interact with the application in a way that causes the host to call [Typed]Func::call_async on a component export, and ensure the component function yields control to the async runtime (e.g., by invoking a host function registered with LinkerInstance::func_wrap_async that yields, or by triggering an epoch interruption).
3. Force premature Future drop: Cause the host embedding to drop the returned Future after only one poll, without awaiting completion — for example, by triggering a timeout, cancellation, or error path in the host application that abandons the in-progress async call.
4. Re-invoke on the same instance: Trigger the host to call call_async again on the same component instance (which is now in a non-reenterable state), causing a trap and allocation of a new task/thread.
5. Trigger the panic: Cause the host to drop this second Future as well (ignoring the trap), which triggers a panic in Wasmtime's runtime during task cleanup, crashing the host application (GitHub Advisory).

• Logs: Rust panic messages in application logs referencing Wasmtime's component runtime, particularly in wasmtime/src/runtime/component/concurrent.rs; stack traces involving task or thread disposal during call_async cleanup.
• Process: Unexpected process crashes or restarts of applications embedding Wasmtime; abnormal thread lifecycle events associated with the Wasmtime async runtime (e.g., Tokio threads not exiting cleanly).
• Application Behavior: Repeated application crashes triggered by specific async WebAssembly component invocations; trap errors logged immediately before a panic during component call_async operations.

Upgrade to Wasmtime 40.0.4, 41.0.4, or any version 42.0.0 and later, which contain the fix for this panic (GitHub Advisory, v40.0.4 Release, v41.0.4 Release). For deployments that cannot upgrade immediately, two workarounds are available: (1) disable the component-model-async Cargo feature at compile time if async component features are not actively used; or (2) ensure all call_async futures are always awaited until completion, and avoid reusing a Store after dropping a not-yet-resolved call_async future.

The vulnerability was first reported by community member dicej via the Bytecode Alliance Zulip chat. The fix was authored and published by alexcrichton of the Bytecode Alliance on February 24, 2026. Brief mentions appeared on Mastodon and Bluesky via The Hacker Wire, and the advisory was picked up by automated security feeds including Red Packet Security and INCIBE-CERT. No significant broader media coverage or notable researcher commentary beyond the official advisory has been observed (GitHub Advisory).