wasmtime vulnerabilities
CVEs whose affected-version data names the wasmtime package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
75 CVEsRSS
CVE-2026-115889Critical· 9.9Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted…
CVE-2026-115385Medium· 6.2Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory acces…
CVE-2026-115381Medium· 4.8Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not confi…
CVE-2026-115380Medium· 4.0Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming …
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type
Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115893Critical· 9.9PoCCranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
RUSTSEC-2026-0380Critical· 9.9Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Bit-packing in Cranelift compiler causes silent overflow and miscompilation
RUSTSEC-2026-0379Critical· 9.9Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
RUSTSEC-2026-0378NonePanic lowering a host-created component model stream into a guest that expects a different payload type
Panic lowering a host-created component model stream into a guest that expects a different payload type
RUSTSEC-2026-0364NoneException tags can cause host data structures to be unaligned
Exception tags can cause host data structures to be unaligned
RUSTSEC-2026-0363Medium· 6.2Component-model handle tables are capped only per instance and charged to no limit
Component-model handle tables are capped only per instance and charged to no limit
RUSTSEC-2026-0362NoneWasmtime may not properly enforce async-entrypoint requirement
Wasmtime may not properly enforce async-entrypoint requirement
RUSTSEC-2026-0361NonePanic when pending calls are run after a trap
Panic when pending calls are run after a trap
RUSTSEC-2026-0360NoneOverlapping string transcode in a fused adapter can panic
Overlapping string transcode in a fused adapter can panic
RUSTSEC-2026-0359Medium· 5.3Stack overflow dropping a long chain of recursive types
Stack overflow dropping a long chain of recursive types
RUSTSEC-2026-0358NoneYielding in a component start function can lead to a host panic
Yielding in a component start function can lead to a host panic
RUSTSEC-2026-0357NoneOut-of-bounds zero-length stream writes can panic
Out-of-bounds zero-length stream writes can panic
RUSTSEC-2026-0356Medium· 5.3Panic on erroneous call-to-host from guest realloc call
Panic on erroneous call-to-host from guest realloc call
RUSTSEC-2026-0355NonePanic viewing component model stream or future as the wrong type
Panic viewing component model stream or future as the wrong type
RUSTSEC-2026-0354NoneHost panic when component `call_async` is cancelled under some conditions
Host panic when component `call_async` is cancelled under some conditions
RUSTSEC-2026-0353NonePanic when invoking an async-lifted function via `call`
Panic when invoking an async-lifted function via `call`
CVE-2026-115384Critical· 9.9Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
CVE-2026-115383Medium· 4.8Mis-typed WebAssembly tag imports can lead to GC heap corruption
Mis-typed WebAssembly tag imports can lead to GC heap corruption
CVE-2026-115379Medium· 5.7Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
RUSTSEC-2026-0327NoneWasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
RUSTSEC-2026-0326Medium· 5.7Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
RUSTSEC-2026-0325NoneMis-typed WebAssembly tag imports can lead to GC heap corruption
Mis-typed WebAssembly tag imports can lead to GC heap corruption
CVE-2026-104855Low· 2.0⚖ disputedWasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder …
CVE-2026-115390Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
CVE-2026-115389Low· 2.3Dynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit