CVE-2026-115391

Name of the Vulnerable Software and Affected Versions Wasmtime versions 46.0.0 through 46.0.2 Wasmtime versions 47.0.0 through 47.0.3

Description The WASIp3 implementation contains an uncontrolled resource allocation issue that buffers guest-specified-length writes on the host without limits. A malicious guest can provide large buffers to WASIp3 file or HTTP write streams, forcing the host to copy and buffer all bytes based on the guest linear memory, which leads to host memory exhaustion.

Recommendations Update Wasmtime to version 46.0.3 or later. Update Wasmtime to version 47.0.4 or later.