| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typeCVE-2026-115892 · GHSA-9PVW-HWFG-92H5Version ranges need review. |
wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Mis-typed WebAssembly tag imports can lead to GC heap corruptionCVE-2026-115383 · GHSA-CFHF-M2CR-62WJ |
wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| fd_readdir copies uninitialized struct padding into guest memoryCVE-2026-115386 · GHSA-96F6-R43R-8C24 |
wasmtime-wasiRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Wasmtime wasi:http implementation panics with a zero timeout suppliedCVE-2026-115382 · GHSA-W4QR-P94G-MJHV |
wasmtime-wasi-httpRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Dynamic record lifting can allocate beyond the hostcall fuel limitCVE-2026-115389 · GHSA-JQPG-J7W6-42PR |
wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| `call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplificationCVE-2026-115390 · GHSA-M63X-6P34-Q65X |
wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Stores can mix up type indices between enginesCVE-2026-115393 · GHSA-HGJW-H833-99Q9 |
wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationCVE-2026-58494 · GHSA-4CH3-9J33-3PMJVersion ranges need review. |
wasmtime-wasiRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Wasmtime has data leakage between pooling allocator instancesCVE-2026-34988 · GHSA-6WGR-89RJ-399PVersion ranges need review. |
wasmtimeRed Hat Connectivity Link 1/redhat-user-workloads/rhcl-1-3-wasm-shim |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 CVE-2026-34944 · GHSA-QQFJ-4VCM-26HVVersion ranges need review. |
wasmtimeRed Hat Connectivity Link 1/redhat-user-workloads/rhcl-1-3-wasm-shim |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Wasmtime: Preemption and traps during bulk operations enable breaking internal VM stateCVE-2026-104855 · GHSA-2HW9-MC66-JC2QVersion ranges need review. |
wasmtimeRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Wasmtime: Panic when transcoding misaligned utf-16 stringsCVE-2026-34942 · GHSA-JXHV-7H78-9775Version ranges need review. |
wasmtimeRed Hat Connectivity Link 1/redhat-user-workloads/rhcl-1-3-wasm-shim |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictionCVE-2026-47261 · GHSA-2R75-CXRJ-CMPHVersion ranges need review. |
wasmtime-wasiRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| Wasmtime has host data leakage with 64-bit tables and WinchCVE-2026-34945 · GHSA-M9W2-8782-2946Version ranges need review. |
wasmtimeRed Hat Connectivity Link 1/redhat-user-workloads/rhcl-1-3-wasm-shim |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Wasmtime has use-after-free bug after cloning `wasmtime::Linker`CVE-2026-34983 · GHSA-HFR4-7C6C-48W2Version ranges need review. |
wasmtimewasmtime |
Rust / CargoPyPIRed Hat |
Low
|
Fix reported |
|
| Wasmtime has improperly masked return value from `table.grow` with Winch compiler backendCVE-2026-35186 · GHSA-F984-PCP8-V2P7Version ranges need review. |
wasmtimeRed Hat Connectivity Link 1/redhat-user-workloads/rhcl-1-3-wasm-shim |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Wasmtime has a leak in WASIp1 `fd_renumber` implementationCVE-2026-54786 · GHSA-3P27-QVP9-27QFVersion ranges need review. |
wasmtime-wasiRed Hat Connectivity Link 1/rhcl-1/wasm-shim-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Wasmtime has out-of-bounds write or crash when transcoding component model stringsCVE-2026-35195 · GHSA-394W-HWHG-8VGMVersion ranges need review. |
wasmtimeRed Hat Connectivity Link 1/redhat-user-workloads/rhcl-1-3-wasm-shim |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
