wasmtime
A lightweight WebAssembly runtime that is fast, secure, and standards-compliant
View on Github
Activity
- Latest release
- 3h ago
- Total releases
- 238
- Cadence
- ~daily
- Last 12 months
- 84
Reach
- Downloads
- 42.2M
- Stars
- 18.8k
Details
- License
- Apache-2.0 WITH LLVM-exception
- First release
- Oct 30, 2018
| Version | Released | |
|---|---|---|
48.0.8
patch
|
48.0.8
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
49.0.5
patch
|
49.0.5
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
50.0.1
patch
|
50.0.1
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.20
patch
|
36.0.20
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
50.0.0
major
|
50.0.0
major
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
48.0.7
patch
|
48.0.7
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
49.0.4
patch
|
49.0.4
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.19
patch
|
36.0.19
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
49.0.3
patch
2 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev |
49.0.3
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
48.0.6
patch
2 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev |
48.0.6
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.18
patch
2 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev |
36.0.18
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
50.0.0-rc.1
pre
|
50.0.0-rc.1
pre
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
48.0.5
patch
13 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
48.0.5
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
48.0.4
patch
13 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
48.0.4
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
49.0.2
patch
14 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0360
GHSA-54p9-vhhq-8f7q
Oct 14, 2026
Overlapping string transcode in a fused adapter can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory. Fixed in
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
49.0.2
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.17
patch
3 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
36.0.17
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
49.0.1
patch
17 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0360
GHSA-54p9-vhhq-8f7q
Oct 14, 2026
Overlapping string transcode in a fused adapter can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory. Fixed in
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev |
49.0.1
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.16
patch
3 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
36.0.16
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
48.0.3
patch
16 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.3
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
49.0.0
major
19 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0360
GHSA-54p9-vhhq-8f7q
Oct 14, 2026
Overlapping string transcode in a fused adapter can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory. Fixed in
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
49.0.0
major
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
48.0.2
patch
18 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.2
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.15
patch
4 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.15
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
49.0.0-rc.1
pre
|
49.0.0-rc.1
pre
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
48.0.1
patch
18 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.1
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.14
patch
4 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.14
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
46.0.3
patch
14 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.3
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
47.0.4
patch
18 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.4
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
24.0.13
patch
4 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.13
patch
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
48.0.0
major
18 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.0
major
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
47.0.3
patch
20 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.3
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
46.0.2
patch
16 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.2
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
36.0.13
patch
5 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.13
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
24.0.12
patch
5 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.12
patch
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
47.0.2
patch
22 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-104855
GHSA-2hw9-mc66-jc2q
RUSTSEC-2026-0223
Oct 02, 2026
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Low
Network
High
High
ImpactWasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as
All of these situations are examples of embedder-driven mutations of the PatchesThis issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large WorkaroundsEmbedders using Fixed in
46.0.2
47.0.3
References
Updated Oct 02, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.2
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
47.0.1
patch
22 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-104855
GHSA-2hw9-mc66-jc2q
RUSTSEC-2026-0223
Oct 02, 2026
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Low
Network
High
High
ImpactWasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as
All of these situations are examples of embedder-driven mutations of the PatchesThis issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large WorkaroundsEmbedders using Fixed in
46.0.2
47.0.3
References
Updated Oct 02, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.1
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
47.0.0
major
22 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0364
GHSA-p79w-pv2r-29qp
Oct 14, 2026
Exception tags can cause host data structures to be unaligned
Medium
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-104855
GHSA-2hw9-mc66-jc2q
RUSTSEC-2026-0223
Oct 02, 2026
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Low
Network
High
High
ImpactWasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as
All of these situations are examples of embedder-driven mutations of the PatchesThis issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large WorkaroundsEmbedders using Fixed in
46.0.2
47.0.3
References
Updated Oct 02, 2026 · Source: OSV.dev
CVE-2026-115383
RUSTSEC-2026-0325
GHSA-cfhf-m2cr-62wj
Oct 02, 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115379
RUSTSEC-2026-0326
GHSA-hw8m-q44c-ggrf
Oct 02, 2026
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115390
RUSTSEC-2026-0315
GHSA-m63x-6p34-q65x
Sep 24, 2026
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
5.7
/ 10
Medium
Network
Low
Low
Required
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory. Fixed in
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.0
major
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
36.0.12
patch
6 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.12
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
45.0.3
patch
8 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
45.0.3
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
46.0.1
patch
18 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-104855
GHSA-2hw9-mc66-jc2q
RUSTSEC-2026-0223
Oct 02, 2026
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Low
Network
High
High
ImpactWasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as
All of these situations are examples of embedder-driven mutations of the PatchesThis issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large WorkaroundsEmbedders using Fixed in
46.0.2
47.0.3
References
Updated Oct 02, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.1
patch
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
24.0.11
patch
6 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.11
patch
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
46.0.0
major
18 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378
Oct 23, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Medium
Network
High
High
SummaryWasmtime may panic when the host lowers a component model GHSA-63h4-6cx9-pjfj is a related advisory also fixing issues within this area, and this advisory is being issued for portions of Wasmtime that were not fixed as part of that advisory. ImpactThis affects embedders that do all of the following:
A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed Fixed in
48.0.7
49.0.4
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0357
GHSA-93g3-36p8-x2gc
Oct 14, 2026
Out-of-bounds zero-length stream writes can panic
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0356
GHSA-7v24-42x9-pxf7
Oct 14, 2026
Panic on erroneous call-to-host from guest realloc call
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0353
GHSA-m6w2-jwq2-cv2c
Oct 14, 2026
Panic when invoking an async-lifted function via `call`
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0361
GHSA-hmwq-g22x-qjw5
Oct 14, 2026
Panic when pending calls are run after a trap
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0355
GHSA-63h4-6cx9-pjfj
Oct 14, 2026
Panic viewing component model stream or future as the wrong type
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0358
GHSA-5hhx-4wrr-3j9g
Oct 14, 2026
Yielding in a component start function can lead to a host panic
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0354
GHSA-3r89-v5mq-j5xf
Oct 14, 2026
Host panic when component `call_async` is cancelled under some conditions
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-104855
GHSA-2hw9-mc66-jc2q
RUSTSEC-2026-0223
Oct 02, 2026
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Low
Network
High
High
ImpactWasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as
All of these situations are examples of embedder-driven mutations of the PatchesThis issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large WorkaroundsEmbedders using Fixed in
46.0.2
47.0.3
References
Updated Oct 02, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115391
RUSTSEC-2026-0268
GHSA-x84v-gj2h-g759
Aug 20, 2026
Guest controlled-size host heap allocation through WASIp3 streams
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory. Fixed in
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.0
major
Dependencies (57)
+ 49 more
Changelog
Compare changes
|
|
24.0.10
patch
6 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.10
patch
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
44.0.3
patch
8 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
44.0.3
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
45.0.2
patch
8 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
45.0.2
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.11
patch
6 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.11
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
45.0.1
patch
8 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
45.0.1
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
44.0.2
patch
8 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
44.0.2
patch
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
36.0.10
patch
6 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.10
patch
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
45.0.0
major
8 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
RUSTSEC-2026-0359
GHSA-wjc8-633q-pwxr
Oct 14, 2026
Stack overflow dropping a long chain of recursive types
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0362
GHSA-vcg5-q8m5-8379
Oct 14, 2026
Wasmtime may not properly enforce async-entrypoint requirement
High
Network
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory. Fixed in
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115384
RUSTSEC-2026-0327
GHSA-32h6-97mm-8q3c
Oct 02, 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Critical
Network
Low
None
None
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
45.0.0
major
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
24.0.9
patch
6 CVEs
CVE-2026-115893
GHSA-mghf-wjfp-p5xm
RUSTSEC-2026-0379
Oct 28, 2026
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one ImpactAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. PatchesWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Fixed in
36.0.19
48.0.7
49.0.4
References
Updated Oct 28, 2026 · Source: OSV.dev
CVE-2026-115889
GHSA-897f-g5gm-fmxm
RUSTSEC-2026-0380
Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
/ 10
Critical
Network
Low
Low
None
Changed
High
High
High
SummaryIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full ImpactA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. PatchesWasmtime v36.0.19 has been released which fixes this issue. Fixed in
36.0.19
43.0.0
References
Updated Oct 23, 2026 · Source: OSV.dev
RUSTSEC-2026-0363
GHSA-q554-3cjc-rx7p
Oct 14, 2026
Component-model handle tables are capped only per instance and charged to no limit
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115389
RUSTSEC-2026-0316
GHSA-jqpg-j7w6-42pr
Sep 24, 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
Medium
Adjacent
High
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115392
RUSTSEC-2026-0269
GHSA-vqjp-4c8c-hfgg
Aug 20, 2026
Filesystem sandbox escape when paths or symlinks contain trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory. Fixed in
24.0.13
36.0.14
46.0.3
47.0.4
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115393
RUSTSEC-2026-0222
GHSA-hgjw-h833-99q9
Jul 31, 2026
Stores can mix up type indices between engines
3.8
/ 10
Low
Local
High
High
Required
Unchanged
Low
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9 For more information see the GitHub-hosted security advisory. Fixed in
24.0.12
36.0.13
46.0.2
47.0.3
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.9
patch
Dependencies (54)
+ 46 more
Changelog
Compare changes
|