wasmtime-wasi
A lightweight WebAssembly runtime that is fast, secure, and standards-compliant
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 235
- Cadence
- ~daily
- Last 12 months
- 80
Reach
- Downloads
- 12.4M
- Stars
- 18.8k
Details
- License
- Apache-2.0 WITH LLVM-exception
- First release
- Aug 21, 2019
| Version | Released | |
|---|---|---|
50.0.0
major
|
50.0.0
major
Dependencies (21)
+ 13 more
Changelog
Compare changes
|
|
48.0.7
patch
|
48.0.7
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
49.0.4
patch
|
49.0.4
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
36.0.19
patch
|
36.0.19
patch
Dependencies (31)
+ 23 more
Changelog
Compare changes
|
|
49.0.3
patch
|
49.0.3
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
48.0.6
patch
|
48.0.6
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
36.0.18
patch
|
36.0.18
patch
Dependencies (31)
+ 23 more
Changelog
Compare changes
|
|
50.0.0-rc.1
pre
|
50.0.0-rc.1
pre
Dependencies (21)
+ 13 more
Changelog
Compare changes
|
|
48.0.5
patch
1 CVE
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
48.0.5
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
48.0.4
patch
1 CVE
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
48.0.4
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
49.0.2
patch
1 CVE
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
49.0.2
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
36.0.17
patch
1 CVE
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev |
36.0.17
patch
Dependencies (31)
+ 23 more
Changelog
Compare changes
|
|
49.0.1
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev |
49.0.1
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
36.0.16
patch
4 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.16
patch
Dependencies (31)
+ 23 more
Changelog
Compare changes
|
|
48.0.3
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.3
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
49.0.0
major
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
49.0.0
major
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
48.0.2
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.2
patch
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
36.0.15
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.15
patch
Dependencies (31)
+ 23 more
Changelog
Compare changes
|
|
49.0.0-rc.1
pre
|
49.0.0-rc.1
pre
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
48.0.1
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.1
patch
Dependencies (22)
+ 14 more
Changelog
Compare changes
|
|
36.0.14
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.14
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
46.0.3
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.3
patch
Dependencies (27)
+ 19 more
Changelog
Compare changes
|
|
47.0.4
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.4
patch
Dependencies (24)
+ 16 more
Changelog
Compare changes
|
|
24.0.13
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.13
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
48.0.0
major
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
48.0.0
major
Dependencies (22)
+ 14 more
Changelog
Compare changes
|
|
47.0.3
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.3
patch
Dependencies (24)
+ 16 more
Changelog
Compare changes
|
|
46.0.2
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.2
patch
Dependencies (27)
+ 19 more
Changelog
Compare changes
|
|
36.0.13
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.13
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
24.0.12
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.12
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
47.0.2
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.2
patch
Dependencies (24)
+ 16 more
Changelog
Compare changes
|
|
47.0.1
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.1
patch
Dependencies (24)
+ 16 more
Changelog
Compare changes
|
|
47.0.0
major
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
47.0.0
major
Dependencies (24)
+ 16 more
Changelog
Compare changes
|
|
36.0.12
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.12
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
45.0.3
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
45.0.3
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
46.0.1
patch
6 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.1
patch
Dependencies (27)
+ 19 more
Changelog
Compare changes
|
|
24.0.11
patch
5 CVEs
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.11
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
46.0.0
major
7 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115385
RUSTSEC-2026-0324
GHSA-mr2v-56j5-cmfc
Oct 02, 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory. Fixed in
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
46.0.0
major
Dependencies (27)
+ 19 more
Changelog
Compare changes
|
|
24.0.10
patch
6 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
24.0.10
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
44.0.3
patch
6 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
44.0.3
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
45.0.2
patch
6 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
45.0.2
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
36.0.11
patch
6 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev |
36.0.11
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
45.0.1
patch
7 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev |
45.0.1
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
44.0.2
patch
7 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev |
44.0.2
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
36.0.10
patch
7 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev |
36.0.10
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
45.0.0
major
7 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev |
45.0.0
major
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
24.0.9
patch
7 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev |
24.0.9
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
36.0.9
patch
8 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-47261
GHSA-2r75-cxrj-cmph
RUSTSEC-2026-0149
Jun 05, 2026
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
SummaryIn The root cause is that the clause that considered The bug in and the single line fix is: Only wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the In particular, the Wasmtime project's Fixed in
24.0.9
36.0.10
44.0.2
References
Updated Sep 10, 2026 · Source: OSV.dev |
36.0.9
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
36.0.8
patch
8 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-47261
GHSA-2r75-cxrj-cmph
RUSTSEC-2026-0149
Jun 05, 2026
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
SummaryIn The root cause is that the clause that considered The bug in and the single line fix is: Only wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the In particular, the Wasmtime project's Fixed in
24.0.9
36.0.10
44.0.2
References
Updated Sep 10, 2026 · Source: OSV.dev |
36.0.8
patch
Dependencies (29)
+ 21 more
Changelog
Compare changes
|
|
43.0.2
patch
8 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-47261
GHSA-2r75-cxrj-cmph
RUSTSEC-2026-0149
Jun 05, 2026
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
SummaryIn The root cause is that the clause that considered The bug in and the single line fix is: Only wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the In particular, the Wasmtime project's Fixed in
24.0.9
36.0.10
44.0.2
References
Updated Sep 10, 2026 · Source: OSV.dev |
43.0.2
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|
|
44.0.1
patch
8 CVEs
CVE-2026-58494
GHSA-4ch3-9j33-3pmj
RUSTSEC-2026-0188
Oct 16, 2026
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
6.5
/ 10
Medium
Local
Low
Low
None
Changed
None
High
None
SummaryWasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a hardlink into another preopen. Details
This makes an attack possible where:
The same attack is possible by way of renaming:
Symbolic links are not a vector for this attack because the wasi-filesystem interfaces already enforces that the destination for a symlink is under the same preopen. We do not believe there are any other vectors to this attack because there are no other wasi filesystem interfaces that take multiple borrows of a descriptor resource for e.g. the source and destination in different descriptors. RemediationThe definition of ImpactOnly wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ, as well as using a second preopen with higher permissions (FilePerms::WRITE as well), are affected by this bug, e.g. those that use in the WasiCtxBuilder: In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. Fixed in
24.0.11
36.0.12
45.0.3
46.0.1
References
Updated Oct 16, 2026 · Source: OSV.dev
RUSTSEC-2026-0352
GHSA-m9f7-9w4p-gv38
Oct 14, 2026
Filesystem sandbox escape when renaming symlinks with trailing slashes
Critical
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory. Fixed in
36.0.18
48.0.6
49.0.3
References Updated Oct 14, 2026 · Source: OSV.dev
CVE-2026-115380
RUSTSEC-2026-0321
GHSA-j366-h8gg-77pm
Oct 02, 2026
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
4.0
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115386
RUSTSEC-2026-0323
GHSA-96f6-r43r-8c24
Oct 02, 2026
fd_readdir copies uninitialized struct padding into guest memory
Medium
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115381
RUSTSEC-2026-0322
GHSA-gqmc-89g8-p25r
Oct 02, 2026
Excessive allocated memory on the host when guests don't have stdio
High
Network
Low
Low
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory. Fixed in
36.0.17
48.0.4
49.0.2
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-115387
RUSTSEC-2026-0314
GHSA-j2g9-4prp-pf6h
Sep 24, 2026
Guest can panic host through filesystem datetime overflow
6.2
/ 10
Medium
Local
Low
None
None
Unchanged
None
None
High
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory. Fixed in
36.0.16
48.0.3
49.0.1
References Updated Oct 24, 2026 · Source: OSV.dev
CVE-2026-54786
GHSA-3p27-qvp9-27qf
RUSTSEC-2026-0182
Aug 26, 2026
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
Low
Network
Low
Low
None
ImpactWasmtime's native implementation of WASIp1 suffers from a leak in the This bug only affects the native implementation of WASIp1. This means that only runtimes which load core wasm modules and expose PatchesWasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 have been released which fix this issue. WorkaroundsThere are no workarounds for this issue and hosts are recommended to update. Fixed in
24.0.10
36.0.11
44.0.3
45.0.2
References
Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-47261
GHSA-2r75-cxrj-cmph
RUSTSEC-2026-0149
Jun 05, 2026
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
High
None
SummaryIn The root cause is that the clause that considered The bug in and the single line fix is: Only wasmtime-wasi embeddings that use a combination of DirPerms::MUTATE with FilePerms::READ are affected by this bug, e.g. those that use in the In particular, the Wasmtime project's Fixed in
24.0.9
36.0.10
44.0.2
References
Updated Sep 10, 2026 · Source: OSV.dev |
44.0.1
patch
Dependencies (28)
+ 20 more
Changelog
Compare changes
|