Live › vulnerability › CVE-2026-115381
Go to dashboardWasmtime's WASIp2 write-zeroes method in SinkOutputStream allocates unbounded zero-filled buffers when stdout or stderr are not configured. A malicious WebAssembly guest can request huge writes and exhaust host memory, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that embed Wasmtime and run untrusted WebAssembly guests through WASIp2 with the default stdout/stderr sink. Hosts that run only trusted guests, or that configure stdout and stderr explicitly, are less exposed.
No product ranges from the sources yet.
wasmtime --version and compare against the fixed releases.36.0.17 on the 36 line, 48.0.4 on the 48 line, or 49.0.2 on the 49 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-115381")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.