Dashboard / CVE-2026-115388

CVE-2026-115388

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 49/100
Published: 2026-10-22 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
AT: None
VC: None
VI: None
VA: High

Description

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on outgoing-body resources, holding host allocations for the store's lifetime and exhausting host memory.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
bytecodealliance wasmtime 0 < 36.0.16

References & Advisories (2)

Bug Bounty Relevance

49 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.11%
Raw Score 0.001120
Percentile 1.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00112
2026-10-28
0.00112

Intelligence Sources

mitre ref →
nvd ref →

External Links