Stream: git-wasmtime

Topic: wasmtime / PR #14408 wasmtime-wasi-http: enforce check-wr...

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 19:34):

pchickey opened PR #14408 from pchickey:fix_ghsa_c9gc_main to bytecodealliance:main:

Fixes https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p

wasmtime-wasi-http does not enforce the write allowance that wasi:io/streams.check-write returns for WASIp2 outgoing HTTP bodies.

A guest can call check-write, get the default configured DEFAULT_OUTGOING_BODY_CHUNK_SIZE of 1M (or whatever value the chunk size has been customized to in an embedder's own WasiHttpHooks impl), and then hand a much larger buffer to write. The write call will succeed for sizes larger than permitted by check-write, disobeying the spec's wasi:io/streams, write precondition which says such a write must trap. Due to this behavior, each outgoing-body resource created by the guest (trivial by way of creating an outgoing-request or outgoing-response) can be used to hold a host allocation of at least one linear memory sized vector for the lifetime of the guest's store.

This PR adds the check that a call to write that the passed list of bytes does not exceed the size permitted by check-write, and traps if it does. This new behavior is checked with a regression test.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 19:34):

pchickey requested dicej for a review on PR #14408.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 19:34):

pchickey requested wasmtime-wasi-reviewers for a review on PR #14408.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 19:34):

pchickey requested wasmtime-core-reviewers for a review on PR #14408.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 20:26):

:thumbs_up: dicej submitted PR review.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 20:28):

pchickey added PR #14408 wasmtime-wasi-http: enforce check-write budget on outgoing bodies to the merge queue.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 20:56):

:check: pchickey merged PR #14408.

view this post on Zulip Wasmtime GitHub notifications bot (Sep 24 2026 at 20:56):

pchickey removed PR #14408 wasmtime-wasi-http: enforce check-write budget on outgoing bodies from the merge queue.

Last updated: Oct 11 2026 at 04:10 UTC