GHSA-3p27-qvp9-27qf

Suggest an improvement
Source
https://github.com/advisories/GHSA-3p27-qvp9-27qf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3p27-qvp9-27qf
Aliases
Downstream
Published
2026-08-26T14:30:10Z
Modified
2026-08-26T14:45:10Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVSS Calculator
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L CVSS Calculator
Summary
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Details

Impact

Wasmtime's native implementation of WASIp1 suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding Store is destroyed. This means that guests can, in a loop, use fd_renumber to cause hosts to exhaust resources or exhaust file descriptors.

This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose fd_renumber are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected.

Patches

Wasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue.

Workarounds

There are no workarounds for this issue and hosts are recommended to update.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T14:30:10Z",
    "nvd_published_at": "2026-07-01T21:17:03Z",
    "severity": "LOW"
}
References

Affected packages

crates.io / wasmtime-wasi

Package

Name
wasmtime-wasi
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime-wasi

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
24.0.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"

crates.io / wasmtime-wasi

Package

Name
wasmtime-wasi
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime-wasi

Affected ranges

Type
SEMVER
Events
Introduced
45.0.0
Fixed
45.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"

crates.io / wasmtime-wasi

Package

Name
wasmtime-wasi
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime-wasi

Affected ranges

Type
SEMVER
Events
Introduced
25.0.0
Fixed
36.0.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"

crates.io / wasmtime-wasi

Package

Name
wasmtime-wasi
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime-wasi

Affected ranges

Type
SEMVER
Events
Introduced
37.0.0
Fixed
44.0.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"