Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-115388

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bytecodealliance wasmtime

Default version status: unaffected

  • 0 to < 36.0.16affected
  • 36.0.16unaffected
  • 37.0.0 to < 48.0.3affected
  • 48.0.3unaffected
  • 49.0.0 to < 49.0.1affected
  • 49.0.1unaffected
pkg:cargo/wasmtime-wasi-http

References