Wasmtime GitHub notifications bot (Sep 24 2026 at 19:33): Wasmtime GitHub notifications bot (Sep 24 2026 at 19:33):cfallin opened PR #14407 from cfallin:fix-cve to bytecodealliance:main:
Previously, fuel instrumentation erroneously used the cached fuel value in the caller, without writing it out to VM state before a funcref call or reloading it afterward. This would result in accumulated fuel usage during the callee's execution being lost, leading to a potential fuel amplification mechanism and thus a DoS vector.
Fixes GHSA-m63x-6p34-q65x (on
main).
Wasmtime GitHub notifications bot (Sep 24 2026 at 19:33):cfallin requested alexcrichton for a review on PR #14407.
Wasmtime GitHub notifications bot (Sep 24 2026 at 19:33):cfallin requested wasmtime-compiler-reviewers for a review on PR #14407.
Wasmtime GitHub notifications bot (Sep 24 2026 at 19:33):cfallin requested wasmtime-core-reviewers for a review on PR #14407.
Wasmtime GitHub notifications bot (Sep 24 2026 at 20:33)::thumbs_up: alexcrichton submitted PR review.
Wasmtime GitHub notifications bot (Sep 24 2026 at 20:33):alexcrichton added PR #14407 Wasmtime Cranelift backend: properly save/restore fuel around call_ref and exception catches. to the merge queue
Wasmtime GitHub notifications bot (Sep 24 2026 at 21:01)::check: alexcrichton merged PR #14407.
Wasmtime GitHub notifications bot (Sep 24 2026 at 21:01):alexcrichton removed PR #14407 Wasmtime Cranelift backend: properly save/restore fuel around call_ref and exception catches. from the merge queue
Last updated: Oct 11 2026 at 04:10 UTC