CVE-2026-115381Medium· 4.8▾ SunlitWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not confi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.
wasmtime < 36.0.17wasmtime >= 37.0.0 < 48.0.4wasmtime >= 49.0.0 < 49.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wasmtime-wasi >= 49.0.0, < 49.0.2Patched in:
wasmtime-wasi 49.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115380Medium· 4.0Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
CVE-2026-115391Medium· 5.8Guest controlled-size host heap allocation through WASIp3 streams
CVE-2026-115389Low· 2.3Dynamic record lifting can allocate beyond the hostcall fuel limit
CVE-2026-115385Medium· 6.2Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
CVE-2026-44216High· 7.5Wasmtime is a runtime for WebAssembly
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type