CVE-2026-115388

The wasmtime-wasi-http component in Wasmtime versions before 36.0.16 , 37.0.0 before 48.0.3 , and 49.0.0 before 49.0.1 fails to enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies. This oversight allows oversized writes to succeed instead of trapping, enabling a mali...