CVE-2026-115381 Details
Description
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.
A denial-of-service vulnerability has been identified in Wasmtime versions prior to 36.0.17, 37.0.0 prior to 48.0.4, and 49.0.0 prior to 49.0.2. The issue arises from an unbounded memory allocation in the wasmtime-wasi crate, specifically in the WASIp2 write-zeroes method of SinkOutputStream. This default stream is used when stdout or stderr are not configured. A malicious WebAssembly guest can exploit this by requesting large zero-filled writes, which exhaust host memory and cause a denial-of-service condition.
Users are advised to upgrade to Wasmtime versions 36.0.17, 48.0.4, or 49.0.2. For embeddings that cannot be immediately updated, a custom implementation of OutputStream can be specified to return a limited value from check_write.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | < 36.0.17 (semver) >= 37.0.0, < 48.0.4 (semver) >= 49.0.0, < 49.0.2 (semver) |
CPE
Remediation
| |
| bytecodealliance Wasmtime-wasi | < 36.0.17 (semver) >= 37.0.0, < 48.0.4 (semver) >= 49.0.0, < 49.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |