wasmtime-wasi-http does not enforce the wasi:io/streams check-write allowance for outgoing HTTP bodies, allowing oversized writes to succeed instead of being trapped. A malicious guest can deliver large buffers to write on outgoing-body resources, causing the host to allocate memory for the lifetime of the store and exhaust system memory, leading to a soft or hard denial of service. The vulnerability targets the memory management subsystem and has been classified as CWE‑400 (Uncontrolled Resource Consumption).

The flaw affects the bytecodealliance:wasmtime library in all versions before 36.0.16, before 37.0.0 version 48.0.3, and before 49.0.0 version 49.0.1. All marketplace or custom deployments using these versions of Wasmtime that expose a wasmtime‑wasi‑http outgoing body interface are potentially impacted.

With a CVSS score of 6.9 the vulnerability presents moderate severity. The EPSS score is not available and the attack is not listed in the CISA KEV catalog, indicating no publicly known exploitation at this time. Attackers would need to run a crafted WASM guest via wasmtime-wasi-http; locally controlled by the host or through an application that accepts untrusted WASM modules. The likelihood of exploitation depends on the presence of such modules; the impact is a denial of service if the malicious guest succeeds in exhausting host memory.