Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-115381

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bytecodealliance wasmtime

Default version status: unaffected

  • 0 to < 36.0.17affected
  • 36.0.17unaffected
  • 37.0.0 to < 48.0.4affected
  • 48.0.4unaffected
  • 49.0.0 to < 49.0.2affected
  • 49.0.2unaffected
pkg:cargo/wasmtime-wasi

References