CVE-2026-115391: Allocation of Resources Without Limits or Throttling in bytecodealliance wasmtime
Description
Wasmtime versions 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contain a vulnerability in the WASIp3 implementation where guest-specified-length writes are buffered without limits. This can lead to excessive memory consumption on the host system, potentially exhausting host memory resources.
CVSS v4.0
Score 6.9medium
Affected software
bytecodealliance
wasmtime
pkg:cargo/github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115391 describes an uncontrolled resource allocation vulnerability in the WASIp3 implementation of Wasmtime. Specifically, guest applications can specify large buffer sizes for file or HTTP write streams, causing the host to buffer all bytes without any throttling or limits. This buffering is only bounded by the guest's linear memory size, which can be large, leading to host memory exhaustion. The affected versions are Wasmtime >=46.0.0 <46.0.3 and >=47.0.0 <47.0.4.
Potential Impact
An attacker controlling a guest can cause the host to allocate excessive memory by specifying large write buffers, potentially leading to denial of service due to host memory exhaustion. The vulnerability requires at least low privileges (PR:L) and user interaction (UI:P) and has a medium severity with a CVSS 4.0 score of 6.9.
Mitigation Recommendations
Upgrading Wasmtime to versions 46.0.3 or later and 47.0.4 or later mitigates this vulnerability. Since the affected versions are explicitly stated, users should apply these official fixes to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:27:18.001Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada64a54d27ba8daa75658a
Added to database: 10/22/2026, 19:31:49 UTC
Last enriched: 10/22/2026, 20:30:56 UTC
Last updated: 10/22/2026, 21:15:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.