MEDIUM6.2

RUSTSEC-2026-0313

Outgoing HTTP body write allows guest-driven host memory exhaustion

Details

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/wasmtime-wasi-http

Introduced in: 0.0.0-0Fixed in: 36.0.16

Upgrade wasmtime-wasi-http to 36.0.16 or newer (ecosystem crates.io).

References

https://crates.io/crates/wasmtime-wasi-http[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2026-0313.html[ADVISORY]
https://github.com/bytecodealliance/wasmtime/pull/14408[WEB]