A vulnerability in the Wasmtime WebAssembly runtime allows authenticated users to trigger a denial of service through resource exhaustion.

The wasmtime-wasi-http crate fails to properly handle excessive header fields, causing the application to panic when reaching capacity limits. This flaw allows an authenticated attacker to crash the runtime, resulting in a denial of service for the affected embedder.

The ability for an attacker to intentionally trigger a panic in the Wasmtime runtime poses a significant threat to service availability. With a CVSS score of 7.5, this vulnerability represents a high risk to business continuity, as it can be leveraged to disrupt services relying on WebAssembly modules. Successful exploitation effectively takes the affected component offline, requiring manual intervention or system restarts to restore service.

Immediate Action: Update Wasmtime to versions 24.0.6, 36.0.6, 40.0.4, 41.0.4, or 42.0.0 to ensure proper error handling and prevent runtime panics.

Proactive Monitoring: Monitor server logs and application health metrics for unexpected process terminations or frequent panic events related to the wasmtime-wasi-http crate.

Compensating Controls: While no direct workaround exists, implement resource limits at the infrastructure level to contain the impact of potential crashes, and ensure high availability configurations are in place to handle service interruptions.

Public Exploit Available: Unknown

Organizations utilizing Wasmtime as a WebAssembly runtime must prioritize upgrading to the patched versions listed above. Given the potential for service disruption, testing and deploying these updates should be conducted immediately to eliminate the risk of denial of service attacks targeting the wasi-http implementation.