Memory Exhaustion Vulnerability in Wasmtime from Bytecode Alliance

CVE-2026-115388

What is CVE-2026-115388?

The wasmtime-wasi-http component in Wasmtime prior to version 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 lacks proper enforcement of the wasi:io/streams check-write allowance for outgoing HTTP bodies. This flaw enables a malicious actor to send oversized buffers, which can lead to excessive host memory allocation and potentially exhaust system resources. This vulnerability poses a significant risk of a denial-of-service condition, as it can hold allocations for the duration of the store's lifetime.

References