Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
Date: 2026-02
Affected: rust/wasmtime, rust/wasmtime, rust/wasmtime
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-27204
CWE: CWE-400
CWE-770
CWE-774
CWE-789

### Impact Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested by the guests. This serves as a Denial of Service vector where a guest can induce a range of crashing behaviors on the host such as: * Allocating arbitrarily large amounts of host memory. * Causing an allocation failure on the host, which in Rust defaults to aborting the process. * Causing a panic on the host due to over-large allocations being performed. * Cause degredation in performance of the host by holding excessive host memory alive. Wasmtime's [security bug policy](https://docs.wasmtime.dev/security-what-is-considered-a-security-vulnerability.html) considers all of these behaviors a security vulnerability. Wasmtime's implementation of WASI has a number of different ways that resource exhaustion could happen, and fixing any one of them is insufficient from solving this vulnerability. A number of individual issues are grouped within this advisory and as a whole represent the known ways that guests can exhaust resources on the host. An example of guest-controlled resource exhaustion within Wasmtime's implementation of WASI is guests could repeatedly allocate handles to themselves without limit. Some APIs also caused the host to perform a guest-controlled-sized allocation of a buffer on the host for I/O operations. Other APIs could force the host to buffer arbitra


Mitigations:

Architectural layers (MAESTRO):