Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes

Medium 4.8

In plain English

A medium-severity resource allocation without limits in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 88.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	rust-wasmtime	no fix listed	DEBIAN-CVE-2026-115381
Debian:14	rust-wasmtime	36.0.20+dfsg-1	DEBIAN-CVE-2026-115381
Ubuntu:24.04:LTS	rust-wasmtime	no fix listed	UBUNTU-CVE-2026-115381
Ubuntu:26.04:LTS	rust-wasmtime	no fix listed	UBUNTU-CVE-2026-115381
Ubuntu:26.10	rust-wasmtime	no fix listed	UBUNTU-CVE-2026-115381

Affected products (as reported)

Vendor	Product	Versions
bytecodealliance	wasmtime	0 – before 36.0.1737.0.0 – before 48.0.449.0.0 – before 49.0.2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-gqmc-89g8-p25r) vendor-advisory
VulnCheck Advisory: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes third-party-advisory