wasmtime
crates.io61 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting wasmtimepage 2 of 2
- CVE-2026-34943HIGHCVSS 7.5EG 7.5fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the se…
- CVE-2026-34944MEDIUMCVSS 5.7EG 5.7fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is neces…
- CVE-2026-34945MEDIUMCVSS 6.5EG 6.5fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size ins…
- CVE-2026-34946HIGHCVSS 7.5EG 7.5fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a v…
- CVE-2026-34971HIGHCVSS 7.8EG 7.8fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address…
- CVE-2026-34983MEDIUMCVSS 5.0EG 5.0fixed in 43.0.12026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder…
- CVE-2026-34987CRITICALCVSS 9.9EG 9.9fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-…
- CVE-2026-34988MEDIUMCVSS 6.3EG 6.3fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one…
- CVE-2026-35186HIGHCVSS 7.5EG 7.5fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit table…
- CVE-2026-35195MEDIUMCVSS 5.4EG 5.4fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated b…
- CVE-2026-44216HIGHCVSS 7.5EG 7.5fixed in 36.0.8, 43.0.2 or 44.0.1, by version range2026-05-14
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus p…
Check whether wasmtime is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for wasmtime CVEs against the assets you own.
Book a Demo →