Search

Find a vulnerability

Search criteria

    Related vulnerabilities

    RUSTSEC-2026-0313 (GHSA-C9GC-W9VX-W86P)

    Vulnerability from osv_rustsec – Published: 2026-09-24 12:00 – Updated: 2026-09-29 07:32 – Source website
    VLAI
    Summary
    Outgoing HTTP body write allows guest-driven host memory exhaustion
    Details

    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory.


    {
      "affected": [
        {
          "database_specific": {
            "categories": [],
            "cvss": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "informational": null
          },
          "ecosystem_specific": {
            "affected_functions": null,
            "affects": {
              "arch": [],
              "functions": [],
              "os": []
            }
          },
          "package": {
            "ecosystem": "crates.io",
            "name": "wasmtime-wasi-http",
            "purl": "pkg:cargo/wasmtime-wasi-http"
          },
          "ranges": [
            {
              "events": [
                {
                  "introduced": "0.0.0-0"
                },
                {
                  "fixed": "36.0.16"
                },
                {
                  "introduced": "37.0.0"
                },
                {
                  "fixed": "48.0.3"
                },
                {
                  "introduced": "49.0.0"
                },
                {
                  "fixed": "49.0.1"
                }
              ],
              "type": "SEMVER"
            }
          ],
          "versions": []
        }
      ],
      "aliases": [
        "GHSA-c9gc-w9vx-w86p"
      ],
      "database_specific": {
        "license": "CC0-1.0"
      },
      "details": "This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p\nFor more information see the GitHub-hosted security advisory.",
      "id": "RUSTSEC-2026-0313",
      "modified": "2026-09-29T07:32:15Z",
      "published": "2026-09-24T12:00:00Z",
      "references": [
        {
          "type": "PACKAGE",
          "url": "https://crates.io/crates/wasmtime-wasi-http"
        },
        {
          "type": "ADVISORY",
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0313.html"
        },
        {
          "type": "WEB",
          "url": "https://github.com/bytecodealliance/wasmtime/pull/14408"
        }
      ],
      "related": [],
      "severity": [
        {
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ],
      "summary": "Outgoing HTTP body write allows guest-driven host memory exhaustion"
    }