CVE-2026-115388: Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write
wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the wasmtime-wasi-http component are affected if they run Wasmtime before 36.0.16, versions 37.0.0 through before 48.0.3, or 49.0.0 before 49.0.1. The issue concerns WASIp2 outgoing HTTP body resources.
What does an attacker need to trigger the denial of service?
An attacker needs the ability to run a malicious guest that can write to outgoing HTTP body resources. The guest can submit oversized buffers to write, causing host allocations to remain held for the lifetime of the store.
How can I determine whether an instance is affected?
Check whether the deployment includes wasmtime-wasi-http, uses WASIp2 outgoing HTTP bodies, and runs an affected Wasmtime release. Vulnerable behavior allows oversized outgoing-body writes to succeed rather than trap when the wasi:io/streams check-write allowance is exceeded.