CVE-2026-27204: 
Rust vulnerability analysis and mitigation

CVE-2026-27204 is a guest-controlled resource exhaustion vulnerability in Bytecode Alliance's Wasmtime WebAssembly runtime, affecting its WASI (WebAssembly System Interface) host interface implementations. A malicious or compromised WebAssembly guest can trigger unbounded resource allocations on the host, serving as a Denial of Service vector. Affected versions include all releases prior to 24.0.6, versions 25.0.0–36.0.5, 37.0.0–40.0.3, and 41.0.0–41.0.3 of the wasmtime Rust crate. The vulnerability was disclosed on February 24, 2026, with patched versions released the same day. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, Wasmtime Advisory).

The root cause is uncontrolled resource consumption (CWE-400, CWE-770, CWE-774, CWE-789) in Wasmtime's WASIp1 and WASIp2 implementations, where no limits were placed on resource allocations requested by guest WebAssembly modules. Specific attack surfaces include: guests repeatedly allocating handles (file descriptors, resources) without limit; APIs that perform guest-controlled-sized buffer allocations on the host for I/O; APIs that force the host to buffer arbitrary amounts of data; and guests passing arbitrarily large allocations to the host, potentially causing quadratically sized memory copies. Any host API modeled with the Component Model (WIT) operating on string or list types is also affected. The issue was originally identified via a WASIp1 memory leak in wasmtime_wasi::p2::host::clocks::subscribe_to_duration, where pollables were created but never dropped, causing unbounded heap growth (GitHub Advisory, PR #12599).

Successful exploitation allows a malicious WebAssembly guest to exhaust host memory and system resources, resulting in high availability impact with no confidentiality or integrity compromise. Specific consequences include: arbitrarily large host memory allocation, process abort due to Rust's default behavior on allocation failure, host panics from over-large allocations, and sustained performance degradation from excessive memory retention. The scope is limited to the host process running Wasmtime, but a crash or abort of the host process can disrupt all co-hosted WebAssembly workloads (Wasmtime Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-27204. The EPSS score is approximately 0.062% (26th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (the attacker must be able to supply a WebAssembly guest module to a vulnerable Wasmtime embedder) and some form of passive user interaction or deployment context, making it more relevant to multi-tenant or plugin-hosting environments (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a service or application embedding Wasmtime versions prior to 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0 that accepts and executes guest-supplied WebAssembly modules (e.g., a plugin host, FaaS platform, or sandbox service).
2. Craft a malicious WebAssembly module: Write a WebAssembly guest (WASIp1 or WASIp2) that repeatedly invokes WASI host APIs to allocate resources without releasing them — for example, continuously opening file descriptors/handles, requesting large random byte buffers via get-random-bytes, or passing oversized strings/lists to host APIs.
3. Submit the module: Upload or supply the crafted .wasm binary to the target embedder through whatever interface is available (API endpoint, file upload, plugin mechanism).
4. Trigger resource exhaustion: Upon execution, the guest module's repeated or oversized WASI calls cause the host to allocate unbounded memory, eventually leading to an allocation failure (process abort in Rust), a panic, or severe performance degradation — effectively denying service to the host and all other guests (GitHub Advisory, Wasmtime Advisory).

• Process Behavior: Rapid, unbounded growth in the memory footprint of the Wasmtime host process (observable via top, htop, or system monitoring tools); unexpected process abort or panic in a Rust-based Wasmtime embedder with out-of-memory errors in logs.
• Logs: Rust panic messages or allocation failure messages (e.g., memory allocation of N bytes failed) in the host application's stderr or log output; repeated WASI host API calls (handle allocation, get-random-bytes, large I/O operations) in any application-level WASI tracing logs.
• File System: Unusually high numbers of open file descriptors associated with the Wasmtime host process (check via /proc/<pid>/fd on Linux or lsof).
• Network: If the embedder is a network-accessible service, sudden unresponsiveness or connection timeouts coinciding with execution of a specific guest module (Wasmtime Advisory).

Upgrade to one of the patched Wasmtime releases: 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0. Note that patched versions prior to 42.0.0 do not enforce limits by default to avoid breaking existing behavior — embedders must explicitly configure the following knobs: ResourceTable::set_max_capacity (or -Smax-resources=N), Store::set_hostcall_fuel (or -Shostcall-fuel=N), WasiCtxBuilder::max_random_size (or -Smax-random-size=N), and WasiHttpCtx::set_max_fields_size (or -Smax-http-fields-size=N). Wasmtime 42.0.0 and later apply sensible defaults (1M max resources, 128MiB hostcall fuel, 64MiB max-random-size, 32KiB HTTP fields size) automatically. There are no known workarounds without upgrading (Wasmtime Advisory, GitHub Advisory).

The advisory was published by Bytecode Alliance maintainer alexcrichton on February 24, 2026, crediting contributor mbund for discovering and reporting the WASIp1 memory leak that led to the broader security investigation. The issue was also tracked in the RustSec advisory database as RUSTSEC-2026-0020. Community coverage appeared on dev.to and security blogs such as infinitsec.net shortly after disclosure, and the vulnerability was picked up by aggregators including Vulners, VulnDB, and INCIBE-CERT (Wasmtime Advisory, RustSec).