CVE-2026-115388

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.16 Wasmtime versions 37.0.0 through 48.0.2 Wasmtime versions 49.0.0 through 49.0.0

Description The wasmtime-wasi-http component fails to enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies. This allows oversized writes to succeed instead of trapping. A malicious guest can exploit this by passing large buffers to write on outgoing-body resources, which holds host allocations for the lifetime of the store and leads to host memory exhaustion.

Recommendations Update Wasmtime to version 36.0.16 or later. Update Wasmtime to version 48.0.3 or later. Update Wasmtime to version 49.0.1 or later.