Unbounded Memory Allocation Vulnerability in Wasmtime by Bytecode Alliance

CVE-2026-115381

What is CVE-2026-115381?

The Wasmtime runtime, prior to specified versions, is susceptible to an unbounded memory allocation in the SinkOutputStream's write-zeroes function. This vulnerability allows a malicious WebAssembly guest to request excessive zero-filled writes, potentially leading to exhaustion of host memory resources. If exploited, it can result in a denial of service, impacting the availability of the host system. Users and developers must ensure they are using updated versions to mitigate this vulnerability.

References