CVE-2026-3385: Wren-Lang Wren DoS Vulnerability

CVE-2026-3385 Overview

A vulnerability has been identified in wren-lang wren up to version 0.4.0. The vulnerability affects the resolveLocal function within the file src/vm/wren_compiler.c. Through manipulation of input, attackers can trigger uncontrolled recursion, leading to a denial of service condition. This vulnerability requires local access to exploit and a proof-of-concept is publicly available.

Critical Impact

Local attackers can cause denial of service through stack exhaustion via uncontrolled recursion in the Wren compiler's local variable resolution function.

Affected Products

• wren-lang wren up to version 0.4.0

Discovery Timeline

• 2026-03-01 - CVE CVE-2026-3385 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3385

Vulnerability Analysis

This vulnerability is classified as uncontrolled recursion (CWE-404), which occurs when the resolveLocal function in the Wren compiler fails to properly limit recursive calls during local variable resolution. The function processes variable scope lookups without adequate depth checking, allowing specially crafted Wren scripts to trigger excessive recursive calls that exhaust the call stack.

The Wren programming language is a small, class-based concurrent scripting language designed for embedding in applications. The compiler component processes source code and is responsible for resolving variable references within local scopes. When processing deeply nested or maliciously constructed scope structures, the recursion depth can grow unbounded.

Root Cause

The root cause lies in improper resource management within the resolveLocal function in src/vm/wren_compiler.c. The function lacks adequate recursion depth limits or iterative alternatives when traversing nested scopes to resolve local variable references. This allows an attacker to craft input that forces the compiler into an unbounded recursive state, eventually exhausting available stack memory and causing a crash.

Attack Vector

The attack requires local access to the system where the Wren interpreter is running. An attacker must be able to provide a specially crafted Wren script to the interpreter for compilation. When the compiler processes this malicious input, the resolveLocal function enters an uncontrolled recursive loop.

The proof-of-concept demonstrating this vulnerability has been publicly disclosed. Detailed reproduction steps are available through the GitHub Issue #1218 and the PoC repository. The exploit causes the compiler to crash through stack exhaustion when processing the malicious input file.

Detection Methods for CVE-2026-3385

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications embedding the Wren interpreter
• Stack overflow errors during Wren script compilation
• Abnormally high CPU usage during Wren code parsing operations
• Core dumps indicating deep call stacks in wren_compiler.c functions

Detection Strategies

• Monitor applications using wren-lang for unexpected terminations or crashes during script compilation
• Implement runtime monitoring for stack depth anomalies in embedded Wren interpreters
• Review application logs for repeated compiler failures when processing user-supplied scripts
• Deploy application-level sandboxing to detect and contain resource exhaustion attempts

Monitoring Recommendations

• Enable stack size monitoring for processes running Wren interpreters
• Set up alerting for abnormal memory usage patterns during script compilation
• Implement logging around Wren script execution entry points to capture malicious input attempts
• Monitor for repeated compilation failures that may indicate exploitation attempts

How to Mitigate CVE-2026-3385

Immediate Actions Required

• Review all applications that embed wren-lang wren version 0.4.0 or earlier
• Restrict the ability for untrusted users to provide Wren scripts for compilation
• Implement input validation and size limits on Wren scripts before compilation
• Consider deploying process isolation for Wren script execution

Patch Information

The wren-lang project maintainers were informed of this vulnerability through GitHub Issue #1218 but have not yet responded. No official patch is currently available. Monitor the wren-lang GitHub repository for updates and security releases.

Workarounds

• Limit stack size for processes running Wren interpreters to prevent complete system resource exhaustion
• Implement pre-compilation validation to reject scripts with excessive nesting or complexity
• Run Wren compilation in sandboxed environments with resource limits
• Restrict Wren script compilation to trusted sources only until an official patch is available

# Example: Set stack size limit for Wren interpreter process
ulimit -s 8192  # Limit stack to 8MB to contain potential exhaustion
# Run Wren interpreter with constrained resources
./wren_cli script.wren