CVE-2026-115391

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams

State: Published
Severity: 6.9 Medium
Published: Oct 22, 2026
Updated: Oct 22, 2026
Reserved: Oct 22, 2026

Description

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H	VulnCheck
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
wasmtimebytecodealliance	46.0.0 to before 46.0.3Affected 46.0.3Not affected 47.0.0 to before 47.0.4Affected 47.0.4Not affected

References

GitHub Security Advisory (GHSA-x84v-gj2h-g759)vendor-advisory
VulnCheck Advisory: Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.