Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

{
  "id": "3142f21faf810116dd5db00d1fcc6734306b9691d129e07c963a8a39e5dc7a99",
  "url": "https://osv.dev/vulnerability/CVE-2026-27195",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future",
    "summary": "Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new implementation of `[Typed]Func::call_async` which made it capable of calling async-typed guest export functions. However, that implementation had a bug leading to a panic under certain circumstances: First, the host embedding calls `[Typed]Func::call_async` on a function exported by a component, polling the returned `Future` once. Second, the component function yields control to the async runtime (e.g. Tokio), e.g. due to a call to host function registered using `LinkerInstance::func_wrap_async` which yields, or due an epoch interruption. Third, the host embedding drops the `Future` after polling it once. This leaves the component instance in a non-reenterable state since the call never had a chance to complete. Fourth, the host embedding calls `[Typed]Func::call_async` again, polling the returned `Future`. Since the component instance cannot be entered at this point, the call traps, but not before allocating a task and thread for the call. Fifth, the host embedding ignores the trap and drops the `Future`. This panics due to the runtime attempting to dispose of the task created above, which panics since the thread has not yet exited. When a host embedder using the affected versions of Wasmtime calls `wasmtime::component::[Typed]Func::call_async` on a guest export and then drops the returned future without waiting for it to r",
    "evidence": "osv:CVE-2026-27195",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-27195",
      "aliases": [
        "CVE-2026-27195",
        "GHSA-xjhv-v822-pf94",
        "RUSTSEC-2026-0022"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/bytecodealliance/wasmtime",
              "type": "GIT",
              "events": [
                {
                  "introduced": "56b81c98a2b4bfea4e7b1d6ac8f2e4196dc83fc1"
                },
                {
                  "fixed": "dc38c5b110862df44e9934ec90dc45e875f18835"
                },
                {
                  "introduced": "3dda916921536c2b5233ec98315b6d05c793a34b"
                },
                {
                  "fixed": "d938a9df47c8e62014c1a12571547411ede6ff5e"
                },
                {
                  "fixed": "9e51c0d9a240a9613d279c061f82286bd11383fd"
                },
                {
                  "fixed": "d86b00736b9ece60b3c81e52f7a7e4cdd9f7d895"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "39.0.0"
                      },
                      {
                        "fixed": "40.0.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "41.0.0"
                      },
                      {
                        "fixed": "41.0.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "9e51c0d9a240a9613d279c061f82286bd11383fd"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d86b00736b9ece60b3c81e52f7a7e4cdd9f7d895"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "dc38c5b110862df44e9934ec90dc45e875f18835"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v40.0.4"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d938a9df47c8e62014c1a12571547411ede6ff5e"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v41.0.4"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v41.0.3",
            "v41.0.2",
            "v41.0.1",
            "v41.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27195.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:35.317384433Z",
      "provider": "osv",
      "references": [
        "https://bytecodealliance.zulipchat.com/#narrow/channel/206238-general/topic/.E2.9C.94.20Panic.20in.20Wasmtime.2041.2E0.2E3.20.28runtime.2Fconcurrent.2Fcomponent.29/with/574438798",
        "https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4",
        "https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27195.json",
        "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-27195",
        "https://github.com/bytecodealliance/wasmtime/commit/9e51c0d9a240a9613d279c061f82286bd11383fd",
        "https://github.com/bytecodealliance/wasmtime/commit/d86b00736b9ece60b3c81e52f7a7e4cdd9f7d895"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-755"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27195.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-27195",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 502280,
  "published_at": "2026-02-24T21:15:20.366+00:00"
}