Executive brief
Guest controlled-size host heap allocation through WASIp3 streams
Affected products
- crates.io wasmtime
Junglewise Threat Intelligence
RUSTSEC-2026-0268 - Guest controlled-size host heap allocation through WASIp3 streams
Severity: medium · CVSS 4 · Published 2026-08-20
Technologies: wasmtime (crates.io). Vendors: crates.io.
Related threats
- RUSTSEC-2026-0269 - Filesystem sandbox escape when paths or symlinks contain trailing slashes
- RUSTSEC-2026-0222 - Stores can mix up type indices between engines
- RUSTSEC-2026-0223 - Preemption and traps during bulk operations enable breaking internal VM state
- Bytecode Alliance Wasmtime denial of service via table allocation panic
- Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler