Security readout for executives and security teams
Plain-English summary
Wasmtime can crash an embedding application when a WebAssembly guest adds an excessive number of WASI HTTP header fields. The issue is a denial-of-service risk, not a data theft or code execution issue in the provided sources. Organizations running untrusted or tenant-supplied WebAssembly through affected Wasmtime versions should prioritize patching.
Executive priority
Treat as a near-term reliability and availability patch for WebAssembly platforms. It is most urgent for customer-facing, multi-tenant, or untrusted-code environments. Lower urgency is reasonable where Wasmtime is not used, WASI HTTP is absent, or only trusted guests run.
Technical view
In wasmtime-wasi-http, the wasi:http/types.fields resource used a backing data structure that could panic at excessive capacity. Wasmtime treats panics in WASI implementations as security issues because they can bring down embedders. Patched versions return a trap to the guest instead of panicking. The issue is classified as CWE-770 with CVSS 4.0 score 6.9.
Likely exposure
Exposure is limited to applications embedding Wasmtime with WASI HTTP support, especially where guest WebAssembly modules are supplied by users, tenants, or other untrusted parties. Affected version ranges include <24.0.6, 25.0.0 to <36.0.6, 37.0.0 to <40.0.4, and 41.0.0 to <41.0.4.
Exploitation context
The source advisory describes a denial-of-service condition caused by excessive header fields. The CVSS vector indicates low attack complexity but some privileges, user interaction, and attack requirements. The provided sources do not report active exploitation, and the CVE is not marked as CISA KEV.
Researcher notes
The public advisory and patch indicate a panic-to-trap hardening change around excessive wasi:http/types.fields capacity. Sources do not provide evidence of code execution, confidentiality impact, or active exploitation. Version text contains a likely typo in one summary, but release and affected ranges identify 40.0.4 as patched.
Mitigation direction
- Upgrade Wasmtime to 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0.
- Update direct and transitive uses of the wasmtime-wasi-http crate.
- If immediate upgrade is blocked, check Bytecode Alliance guidance; no workaround is listed.
- Prioritize systems running untrusted or multi-tenant WebAssembly workloads.
Validation and detection
- Inventory applications embedding Wasmtime or depending on wasmtime-wasi-http.
- Compare deployed versions against the affected ranges in the advisory.
- Confirm upgraded builds use one of the patched versions listed by Bytecode Alliance.
- Review service reliability logs for unexplained Wasmtime host panics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27572 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264hCVE reference · x_refsource_CONFIRM
- https://github.com/bytecodealliance/wasmtime/commit/301dc7162cca51def19131019af1187f45901c0aCVE reference · x_refsource_MISC
- https://docs.rs/http/1.4.0/http/header/#limitationsCVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.6CVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.6CVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4CVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.