CVE-2026-115388 bytecodealliance CVE debrief

Who should care

Defenders responsible for systems using the wasmtime-wasi-http package should assess exposure and prioritize patching to prevent potential memory exhaustion attacks. This includes operators, security teams, and vulnerability management teams. They should verify affected versions and apply patches to prevent potential memory exhaustion attacks. Implementing compensating controls could help limit the impact of a potential attack.

Why it matters

Defenders should prioritize verifying affected versions and applying patches to prevent potential memory exhaustion attacks using CVE-2026-115388 in wasmtime-wasi-http.

• Potential memory exhaustion attacks could lead to denial-of-service conditions
• Verification of affected versions and patching is necessary to prevent exploitation
• Implementing compensating controls could help limit the impact of a potential attack

Technical summary

The vulnerability exists in the wasmtime-wasi-http package and allows a guest to drive the host to memory exhaustion via outgoing HTTP body writes. The affected versions are 0.0.0-0 to 36.0.16, 37.0.0 to 48.0.3, and 49.0.0 to 49.0.1. Defenders should prioritize verifying affected versions and applying patches to prevent potential memory exhaustion attacks. This vulnerability can lead to denial-of-service conditions and implementing compensating controls could help limit the impact of a potential attack. The vulnerability is described in the RustSec database and related to the Wasmtime security advisory GHSA-c9gc-w9vx-w86p.

Defensive priority

Defenders should prioritize verifying affected versions and applying patches to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Verify affected versions of wasmtime-wasi-http and apply patches
• Monitor for potential memory exhaustion attacks
• Implement compensating controls to limit the impact of a potential attack
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the RustSec database and is related to the Wasmtime security advisory GHSA-c9gc-w9vx-w86p. The affected package is wasmtime-wasi-http. The vulnerability allows a guest to drive the host to memory exhaustion via outgoing HTTP body writes. Defenders should verify affected versions and apply patches to prevent potential memory exhaustion attacks. Evidence is limited to public sources and CVE Program records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.