AIKIDO-2026-794360
wasmtime-wasi-http is vulnerable to Denial of Service (DoS)
59
Medium Risk
This Affects:
wasmtime-wasi-httpTL;DR
Wasmtime's wasi:http implementation forwards the guest supplied between-bytes-timeout duration directly to a Tokio timer API without validating it first. Tokio panics when given a zero length duration, so a guest that requests a 0 timeout on an outgoing request triggers a host panic. The flaw reaches any embedder using the wasmtime-wasi-http crate's default-send-request Cargo feature, which ships enabled by default. The fix clamps the forwarded timeout to a minimum of one nanosecond before it reaches Tokio.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use Wasmtime's wasi:http implementation with the default default-send-request feature enabled.
Background info
wasmtime-wasi-http is vulnerable to Denial of Service (DoS) in versions 46.0.0 - 48.0.3 and 49.0.0 - 49.0.1.
How to fix this
Upgrade the wasmtime-wasi-http library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.