AIKIDO-2026-862298

wasmtime-wasi is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-mr2v-56j5-cmfc Published Oct 7, 2026

Medium Risk

This Affects:

wasmtime-wasi

46.0.0 - 48.0.3

Fixed in 48.0.4

49.0.0 - 49.0.1

Fixed in 49.0.2

Are you affected? Scan for Free

TL;DR

Wasmtime's WASIp3 implementation on Unix hosts converts a guest supplied filesystem timestamp into a system specific representation and asserts that the timestamp is after the Unix epoch. A guest can call set-times or set-times-at with a negative seconds value to supply a timestamp before the epoch, which fails that assertion and aborts the host process. Only Unix hosts that expose a preopened descriptor with mutable access are affected; read only filesystem views and Windows hosts are not. The fix replaces the assertion with a bounds check that returns an error instead of aborting.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run on a Unix host while giving the guest a preopened descriptor with mutable filesystem access through WASIp3.