Security
فارسی
All products

wasmtime

Rust / Cargo · Package
66 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-checkGHSA-3982-JQVV-277M · RUSTSEC-2026-0422 wasmtime Rust / Cargo Low Fix reported
Unchecked memory usage in transferring borrowed resources between componentsGHSA-6FR9-XMW9-5352 · RUSTSEC-2026-0424 wasmtime Rust / Cargo Unknown Fix reported
Cross-engine type confusion with host-created struct-types-with-supertypesGHSA-QW58-7H65-CRQ2 · RUSTSEC-2026-0423 wasmtime Rust / Cargo Unknown Fix reported
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionCVE-2026-115893 · GHSA-MGHF-WJFP-P5XMVersion ranges need review. wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Critical Fix reported
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationCVE-2026-115889 · GHSA-897F-G5GM-FMXMVersion ranges need review. wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Critical Fix reported
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typeCVE-2026-115892 · GHSA-9PVW-HWFG-92H5Version ranges need review. wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Medium Fix reported
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflowCVE-2026-115384 · GHSA-32H6-97MM-8Q3C wasmtime Rust / Cargo Critical Fix reported
Rooting for GC values live across `try_call` may be missing, causing GC heap corruptionCVE-2026-115379 · GHSA-HW8M-Q44C-GGRF wasmtime Rust / Cargo Medium Fix reported
Mis-typed WebAssembly tag imports can lead to GC heap corruptionCVE-2026-115383 · GHSA-CFHF-M2CR-62WJ wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Medium Fix reported
Dynamic record lifting can allocate beyond the hostcall fuel limitCVE-2026-115389 · GHSA-JQPG-J7W6-42PR wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Low Fix reported
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplificationCVE-2026-115390 · GHSA-M63X-6P34-Q65X wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Medium Fix reported
Filesystem sandbox escape when paths or symlinks contain trailing slashesCVE-2026-115392 · GHSA-VQJP-4C8C-HFGG wasmtime Rust / Cargo High Fix reported
Guest controlled-size host heap allocation through WASIp3 streamsCVE-2026-115391 · GHSA-X84V-GJ2H-G759 wasmtime Rust / Cargo Medium Fix reported
Stores can mix up type indices between enginesCVE-2026-115393 · GHSA-HGJW-H833-99Q9 wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 Rust / CargoRed Hat Low Fix reported
Panic when invoking an async-lifted function via `call`GHSA-M6W2-JWQ2-CV2C · RUSTSEC-2026-0353 wasmtime Rust / Cargo Medium Fix reported
Exception tags can cause host data structures to be unalignedGHSA-P79W-PV2R-29QP · RUSTSEC-2026-0364 wasmtime Rust / Cargo Low Fix reported
Panic when pending calls are run after a trapGHSA-HMWQ-G22X-QJW5 · RUSTSEC-2026-0361 wasmtime Rust / Cargo Medium Fix reported
Panic viewing component model stream or future as the wrong typeGHSA-63H4-6CX9-PJFJ · RUSTSEC-2026-0355 wasmtime Rust / Cargo Medium Fix reported
Host panic when component `call_async` is cancelled under some conditionsGHSA-3R89-V5MQ-J5XF · RUSTSEC-2026-0354 wasmtime Rust / Cargo Medium Fix reported
Wasmtime may not properly enforce async-entrypoint requirementGHSA-VCG5-Q8M5-8379 · RUSTSEC-2026-0362 wasmtime Rust / Cargo Medium Fix reported