UBUNTU-CVE-2026-119142

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-119142
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119142.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-119142
Upstream
Published
2026-10-29T16:18:00Z
Modified
2026-11-05T04:42:51Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.

References

Affected packages

Ubuntu:24.04:LTS / rust-wasmtime

Package

Name
rust-wasmtime
Purl
pkg:deb/ubuntu/rust-wasmtime?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.0.1+dfsg-7
15.*
15.0.1+dfsg-4
16.*
16.0.0+dfsg-2
16.0.0+dfsg-3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.103.0+16.0.0+dfsg-3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119142.json"

Ubuntu:26.10 / rust-wasmtime

Package

Name
rust-wasmtime
Purl
pkg:deb/ubuntu/rust-wasmtime?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

36.*
36.0.5+dfsg-1
36.0.13+dfsg-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.123.13+36.0.13+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119142.json"

Ubuntu:26.04:LTS / rust-wasmtime

Package

Name
rust-wasmtime
Purl
pkg:deb/ubuntu/rust-wasmtime?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

26.*
26.0.1+dfsg-3
26.0.1+dfsg-4
28.*
28.0.1+dfsg-3
29.*
29.0.1+dfsg-5
36.*
36.0.5+dfsg-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.123.5+36.0.5+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-119142.json"