{"schema":"threatline.record/2","record":{"id":"CVE-2026-115892","aliases":["GHSA-9pvw-hwfg-92h5","RUSTSEC-2026-0378"],"summary":"Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type","details":"### Summary\n\nWasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host created that stream or future with one payload type and the guest expects a different one. This can happen when an embedder creates a stream or future, passes it through a guest, receives it back under a type-erased type such as `StreamAny` or `FutureAny`, and then passes it to a guest function with a different payload type.\n\nGHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory.\n\n### Impact\n\nThis affects embedders that do all of the following:\n\n1. Create streams or futures on the host with `StreamReader::new` or `FutureReader::new`\n2. Pass them to guest code and receive them back as `StreamAny`, `FutureAny`, `Val::Stream`/`Val::Future`, or a typed reader whose payload is one of these.\n3. Pass them on to a guest function whose `stream` or `future` payload type differs from the type the host created them with.\n\nA guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed `StreamReader<T>`/`FutureReader<T>` with concrete payload types throughout, or that never pass streams or futures they created through a guest and back, are not affected.","categories":["Libraries & packages"],"product":"wasmtime","vendor":"bytecodealliance","ecosystem":"rust","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:04:47Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"range":">= 46.0.0, < 48.0.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:04:47Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"range":">= 49.0.0, < 49.0.4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115892","source_modified_at":"2026-10-23T21:26:54.528Z","fetched_at":"2026-10-23T21:47:51.402276Z","product":"wasmtime","vendor":"bytecodealliance","versions":[{"status":"affected","version":">= 46.0.0, < 48.0.7"},{"status":"affected","version":">= 49.0.0, < 49.0.4"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:25:32.526713550Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"46.0.0"},{"fixed":"48.0.7"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:25:32.526713550Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"49.0.0"},{"fixed":"49.0.4"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:04:47Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"version":"48.0.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:04:47Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"version":"49.0.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:25:32.526713550Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"version":"48.0.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5","source_modified_at":"2026-10-23T22:25:32.526713550Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"version":"49.0.4"}],"cvss":5.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T21:26:54.528Z","modified_at":"2026-10-23T22:25:32.526713550Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-10-23T22:04:47Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115892","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23T21:26:54.528Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-10-23T22:25:32.526713550Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/pull/14819","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/pull/14820","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/pull/14827","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","tags":["x_refsource_MISC"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0378.html","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T22:25:32.526713550Z","content_hash":"0a118c20d07ca2ebdc32ea27c5bb13488da90287e6349efb2e81da1b27456b90"}}