CVE-2026-115388: Uncontrolled Resource Consumption in bytecodealliance wasmtime
Description
CVE-2026-115388 is a vulnerability in the wasmtime-wasi-http component of Wasmtime that allows uncontrolled resource consumption. Versions before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 do not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies. This flaw permits a malicious guest to write oversized buffers to outgoing HTTP body resources, causing host memory exhaustion by holding allocations for the store's lifetime.
CVSS v4.0
Score 6.9medium
Affected software
bytecodealliance
wasmtime
pkg:cargo/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in wasmtime-wasi-http affects Wasmtime versions prior to 36.0.16, 48.0.3, and 49.0.1. It arises because the component does not enforce the wasi:io/streams check-write allowance on WASIp2 outgoing HTTP bodies. Consequently, oversized writes succeed instead of being trapped, allowing a malicious guest to allocate large buffers on outgoing-body resources. These allocations persist for the lifetime of the store, potentially exhausting host memory and causing denial of service due to resource exhaustion.
Potential Impact
A malicious guest can exploit this vulnerability to cause excessive memory consumption on the host by passing large buffers to write on outgoing HTTP body resources. This leads to resource exhaustion, which can degrade performance or cause denial of service on the host system running Wasmtime.
Mitigation Recommendations
A fix is available in Wasmtime versions 36.0.16, 48.0.3, and 49.0.1 and later. Users should upgrade to these or later versions to remediate this vulnerability. Patch status is confirmed by the affected version ranges indicating fixed versions. No additional mitigation steps are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:25:27.611Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada64a34d27ba8daa75657a
Added to database: 10/22/2026, 19:31:47 UTC
Last enriched: 10/22/2026, 20:31:06 UTC
Last updated: 10/22/2026, 21:15:20 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.