# CVE-2026-27195: wasmtime — Fixed in 40.0.4 🦀 crates.io Not in CISA KEV # CVE-2026-27195 — wasmtime [Fix: bytecodealliance/wasmtime@9e51c0d](https://github.com/bytecodealliance/wasmtime/commit/9e51c0d9a240a9613d279c061f82286bd11383fd) CVE-2026-27195 is a CWE-755 vulnerability in wasmtime. A fix is available for wasmtime — see the affected versions and patch details below. Wasmtime is vulnerable to panic when dropping a \`\[Typed\]Func::call\_async\` future Also known as[GHSA-xjhv-v822-pf94](/vulnerability/GHSA-xjhv-v822-pf94)RUSTSEC-2026-0022 Published Feb 24, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27195. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs36th percentile — riskier than 36% of all scored CVEsHighest risk 0.00%0.37%0.75%1.12%0.1%0.4%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 2 pkgs affected 🦀`wasmtime`🦀`wasmtime` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems. ## Description The affected versions of Wasmtime can panic if the host embedder drops the future returned by `wasmtime::component::[Typed]Func::call_async` before it resolves. #### Details Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new implementation of `[Typed]Func::call_async` which made it capable of calling async-typed guest export functions. However, that implementation had a bug leading to a panic under certain circumstances: 1. The host embedding calls `[Typed]Func::call_async` on a function exported by a component, polling the returned `Future` once. 2. The component function yields control to the async runtime (e.g. Tokio), e.g. due to a call to host function registered using `LinkerInstance::func_wrap_async` which yields, or due an epoch interruption. 3. The host embedding drops the `Future` after polling it once. This leaves the component instance in a non-reenterable state since the call never had a chance to complete. 4. The host embedding calls `[Typed]Func::call_async` again, polling the returned `Future`. Since the component instance cannot be entered at this point, the call traps, but not before allocating a task and thread for the call. 5. The host embedding ignores the trap and drops the `Future`. This panics due to the runtime attempting to dispose of the task created above, which panics since the thread has not yet exited. #### Impact When a host embedder using the affected versions of Wasmtime calls `wasmtime::component::[Typed]Func::call_async` on a guest export and then drops the returned future without waiting for it to resolve, and then does so again with the same component instance, Wasmtime will panic. Embeddings that have the `component-model-async` compile-time feature disabled are unaffected. #### Patches Wasmtime 40.0.4 and 41.0.4 have been patched to fix this issue. Versions 42.0.0 and later are not affected. #### Workarounds If an embedding is not actually using any component-model-async features then disabling the `component-model-async` Cargo feature can work around this issue. This issue can also be worked around by either ensuring every `call_async` future is awaited until it completes or refraining from using the `Store` again after dropping a not-yet-resolved `call_async` future. #### Resources This was first reported in [https://bytecodealliance.zulipchat.com/#narrow/channel/206238-general/topic/Panic.20in.20Wasmtime.2041.2E0.2E3.20.28runtime.2Fconcurrent.2Fcomponent.29](https://bytecodealliance.zulipchat.com/#narrow/channel/206238-general/topic/Panic.20in.20Wasmtime.2041.2E0.2E3.20.28runtime.2Fconcurrent.2Fcomponent.29) ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 🦀crates.io `wasmtime` ≥ 39.0.0&&< 40.0.4 40.0.4`cargo update -p wasmtime --precise 40.0.4` 🦀crates.io `wasmtime` ≥ 41.0.0&&< 41.0.4 41.0.4`cargo update -p wasmtime --precise 41.0.4` ## Affected Products 1 product · 2 configurations Application `wasmtime`bytecodealliance ≥ 41.0.0 && < 41.0.4 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for wasmtime, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update wasmtime to 40.0.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27195 is resolved across your whole dependency graph. 3. ### Workarounds If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatModerate Workaround published by Red Hat > Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Source: [Red Hat security advisory for CVE-2026-27195](https://access.redhat.com/security/cve/cve-2026-27195) (CC BY 4.0) ## Frequently Asked Questions The affected versions of Wasmtime can panic if the host embedder drops the future returned by \`wasmtime::component::\[Typed\]Func::call\_async\` before it resolves. ### Details Starting with Wasmtime 39.0.0, the \`component-model-async\` feature became the default, which brought with it a new implementation of \`\[Typed\]Func::call\_async\` which made it capable of calling async-typed guest export functions. However, that implementation had a bug leading to a panic under certain circumstances: 1. The host embedding calls \`\[Typed\]Func::call\_async\` on a function exported by a component, polling the ret O3 Security · Impact-Aware SCA ### Is CVE-2026-27195 in your dependencies? Find it across crates.io, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)