Uncontrolled Resource Allocation Vulnerability in Wasmtime by Bytecode Alliance

CVE-2026-115391

What is CVE-2026-115391?

An uncontrolled resource allocation issue exists in Wasmtime, specifically in its WASIp3 implementation. This vulnerability allows untrusted guests to request significant amounts of memory via file or HTTP write streams, leading to potential exhaustion of host memory. As the guest specifies the length of the buffers, the system can become overloaded if not properly managed. This can result in severe performance degradation and potential denial of service situations. Users are advised to upgrade to patched versions to mitigate the risk associated with this vulnerability.

References