All vulnerabilities
CVE-2026-115391GHSA-x84v-gj2h-g759

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams

bytecodealliance wasmtime
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in46.0.3Also 47.0.4CVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.

Text from CVE List

Affected versions 4

  • wasmtimeaffected: 46.0.0 before 46.0.3CVE List
  • wasmtimeunaffected: 46.0.3CVE List
  • wasmtimeaffected: 47.0.0 before 47.0.4CVE List
  • wasmtimeunaffected: 47.0.4CVE List

References 2