All vulnerabilities
CVE-2026-115388GHSA-c9gc-w9vx-w86p

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write

bytecodealliance wasmtime
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in36.0.16Also 48.0.3, 49.0.1CVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.

Text from CVE List

Affected versions 7

  • wasmtimeaffected: all versions before 36.0.16CVE List
  • wasmtimeunaffected: 36.0.16CVE List
  • wasmtimeaffected: 37.0.0 before 48.0.3CVE List
  • wasmtimeunaffected: 48.0.3CVE List
  • wasmtimeaffected: 49.0.0 before 49.0.1CVE List
  • wasmtimeunaffected: 49.0.1CVE List
  • wasmtime-wasi-http, rust< 36.0.16, >= 37.0.0, >= 47.0.0, < 48.0.3, 49.0.0GitHub

References 2