Answer in brief
CVE-2026-126410 records a Medium severity (CVSS 5.3) vulnerability in Wasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Sockets. The current sources do not mark it as known exploited. The current feed maps bytecodealliance/wasmtime (generic), bytecodealliance/wasmtime (generic), bytecodealliance/wasmtime (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps bytecodealliance/wasmtime (generic), bytecodealliance/wasmtime (generic), bytecodealliance/wasmtime (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| bytecodealliance/wasmtimegeneric | >=48.0.0 <48.0.8 | 48.0.8 |
| bytecodealliance/wasmtimegeneric | >=49.0.0 <49.0.5 | 49.0.5 |
| bytecodealliance/wasmtimegeneric | >=50.0.0 <50.0.1 | 50.0.1 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a time-of-check/time-of-use race in the wasip3 wasi:sockets udp-socket host implementation that lets guests bypass socket_addr_check send restrictions. A malicious guest can race udp-socket.send against udp-socket.connect to deliver attacker-controlled datagrams to addresses the policy permits only for receiving.
Quoted source text, attributed separately from HOL analysis.