{"id":"GHSA-3p27-qvp9-27qf","summary":"Wasmtime has a leak in WASIp1 `fd_renumber` implementation","details":"### Impact\n\nWasmtime's native implementation of WASIp1 suffers from a leak in the `fd_renumber` function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while `fd_renumber` works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding `Store` is destroyed. This means that guests can, in a loop, use `fd_renumber` to cause hosts to exhaust resources or exhaust file descriptors.\n\nThis bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose `fd_renumber` are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected.\n\n### Patches\n\nWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue.\n\n### Workarounds\n\nThere are no workarounds for this issue and hosts are recommended to update.","aliases":["CVE-2026-54786","RUSTSEC-2026-0182"],"modified":"2026-08-26T14:45:10.469817244Z","published":"2026-08-26T14:30:10Z","database_specific":{"github_reviewed_at":"2026-08-26T14:30:10Z","nvd_published_at":"2026-07-01T21:17:03Z","cwe_ids":["CWE-400"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54786"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/13650"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/100bfe27253d2ce5154ddddf66d06e30f3fa6824"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/36b305d827149ac0336ddcbc0a378c303339d195"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/72493b11ed5df382c92a9dfb8b6bc064e471f1cd"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/e9fbe974c9698edef117323d981e13caf2097c13"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/f069f125cb77a4a3dced19a77d73790610678622"},{"type":"PACKAGE","url":"https://github.com/bytecodealliance/wasmtime"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.10"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.11"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v44.0.3"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.2"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0182.html"}],"affected":[{"package":{"name":"wasmtime-wasi","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"24.0.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"}},{"package":{"name":"wasmtime-wasi","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"45.0.0"},{"fixed":"45.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"}},{"package":{"name":"wasmtime-wasi","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"36.0.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"}},{"package":{"name":"wasmtime-wasi","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"44.0.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-3p27-qvp9-27qf/GHSA-3p27-qvp9-27qf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"}]}