CVE-2026-115381: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.20+dfsg-1 - Upgrade
Upgrade
wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.17 - Upgrade
Upgrade
wasmtimeto a version that resolves this vulnerability.Fixed in 48.0.4 - Upgrade
Upgrade
wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the affected Wasmtime versions are exposed when they run untrusted or malicious WebAssembly guests and stdout or stderr are left unconfigured, causing Wasmtime to use SinkOutputStream.
What must an attacker be able to do?
An attacker needs the ability to run a malicious WebAssembly guest and induce a write-zeroes call with a very large requested write size. The attack can exhaust host memory and cause denial of service; no confidentiality or integrity impact is described.
Are default stream settings affected?
Yes. SinkOutputStream is the default stream when stdout or stderr are not configured, so applications that omit stream configuration can be affected.
Which versions contain fixes?
The issue is fixed in Wasmtime 36.0.17, 48.0.4, and 49.0.2. Affected ranges are versions before 36.0.17, versions from 37.0.0 before 48.0.4, and versions from 49.0.0 before 49.0.2.