CVE-2026-115391
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
- Record
CVE-2026-115391- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-04
EUVDEUVD-2026-108324
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
- Record
EUVD-2026-108324- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-6862-f859-6m9r
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource...
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
- Record
GHSA-6862-f859-6m9r- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
- Record
CVE-2026-115391- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-04
OSV
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
- Record
CVE-2026-115391- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Weakness
- CWE-770
- Updated
- 2026-11-05
OSVRUSTSEC-2026-0268
Guest controlled-size host heap allocation through WASIp3 streams
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory.
- Record
RUSTSEC-2026-0268- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-115391
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
- Record
UBUNTU-CVE-2026-115391- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wasmtimecrates.io |
46.0.0 up to 46.0.3, 47.0.0 up to 47.0.4 | 46.0.347.0.4 |
rust-wasmtimeUbuntu:24.04:LTS |
All versions, plus listed versions 10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3 |
None known |
rust-wasmtimeUbuntu:26.10 |
All versions, plus listed versions 36.0.5+dfsg-136.0.13+dfsg-1 |
None known |
rust-wasmtimeUbuntu:26.04:LTS |
All versions, plus listed versions 26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115391 is a medium vulnerability (CVSS 6.9) in Bytecodealliance Wasmtime, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in wasmtime 46.0.3.
References
github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759
vulncheck.com/advisories/wasmtime-46.0.0-before-46.0.3-and-47.0.0-before-47.0.4-unbounded-heap-allocation-via-wasip3-streams
nvd.nist.gov/vuln/detail/CVE-2026-115391
crates.io/crates/wasmtime