wasmtime
crates.io40 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting wasmtimepage 1 of 1
- CVE-2021-39216MEDIUMCVSS 6.3EG 6.3fixed in 0.30.02021-09-17
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have…
- CVE-2021-39218MEDIUMCVSS 6.3EG 6.3fixed in 0.30.02021-09-17
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when run…
- CVE-2021-39219MEDIUMCVSS 6.3EG 6.3fixed in 0.30.02021-09-17
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, …
- CVE-2022-23636MEDIUMCVSS 5.1EG 5.1fixed in 0.38.2, 0.34.1 or 0.33.1, by version range2022-02-16
vulnerable: 0.34.0
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines…
- CVE-2022-24791HIGHCVSS 8.1EG 8.1fixed in 0.34.2 or 0.35.2, by version range2022-03-31
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explic…
- CVE-2022-31104MEDIUMCVSS 4.8EG 4.8fixed in 0.38.12022-06-28
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 …
- CVE-2022-31146MEDIUMCVSS 6.4EG 6.4fixed in 0.38.22022-07-21
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means tha…
- CVE-2022-31169MEDIUMCVSS 5.9EG 5.9fixed in 0.38.2, 0.34.1 or 0.33.1, by version range2022-07-22
vulnerable: 0.34.0
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to versi…
- CVE-2022-39392MEDIUMCVSS 5.9EG 5.9fixed in 2.0.2 or 1.0.2, by version range2022-11-10
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages …
- CVE-2022-39393HIGHCVSS 8.6EG 8.6fixed in 2.0.2 or 1.0.2, by version range2022-11-10
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap s…
- CVE-2022-39394LOWCVSS 3.8EG 3.8fixed in 2.0.2 or 1.0.2, by version range2022-11-10
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` hea…
- CVE-2023-26489CRITICALCVSS 9.9EG 9.9fixed in 4.0.1, 5.0.1 or 6.0.1, by version range2023-03-08
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of W…
- CVE-2023-27477LOWCVSS 3.1EG 3.1fixed in 4.0.1, 5.0.1 or 6.0.1, by version range2023-03-08
wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand i…
- CVE-2023-30624LOWCVSS 3.9EG 3.9fixed in 6.0.2, 7.0.1 or 8.0.1, by version range2023-04-27
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined beha…
- CVE-2023-41880MEDIUMCVSS 5.3EG 5.3fixed in 10.0.2, 11.0.2 or 12.0.2, by version range2023-09-15
Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a cons…
- CVE-2024-30266LOWCVSS 3.3EG 3.3fixed in 19.0.12024-04-04
vulnerable: 19.0.0
wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, whe…
- CVE-2024-47763MEDIUMCVSS 5.5EG 5.5fixed in 21.0.2, 22.0.1, 23.0.3, 24.0.1 or 25.0.2, by version range2024-10-09
Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if…
- CVE-2024-47813LOWCVSS 2.9EG 2.9fixed in 21.0.2, 22.0.1, 23.0.3, 24.0.1 or 25.0.2, by version range2024-10-09
Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potent…
- CVE-2024-51745CRITICALCVSS 10.0EG 10.0fixed in 24.0.2, 25.0.3 or 26.0.1, by version range2024-11-05
vulnerable: 26.0.0
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to …
- CVE-2025-53901LOWCVSS 3.5EG 3.5fixed in 24.0.4, 33.0.2 or 34.0.2, by version range2025-07-18
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The spec…
- CVE-2025-62711LOWCVSS 3.1EG 3.1fixed in 38.0.32025-10-24
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which w…
- CVE-2025-64345LOWCVSS 1.8EG 1.8fixed in 38.0.4, 37.0.3, 36.0.3 or 24.0.5, by version range2025-11-12
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe…
- CVE-2026-104855LOWCVSS 2.0EG 2.0fixed in 46.0.2 or 47.0.3, by version range2026-10-02
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mu…
- CVE-2026-24116MEDIUMCVSS 5.5EG 5.5fixed in 36.0.5, 40.0.3 or 41.0.1, by version range2026-01-27
vulnerable: 41.0.0
Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8…
- CVE-2026-27195HIGHCVSS 7.5EG 7.5fixed in 40.0.4 or 41.0.4, by version range2026-02-24
Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new implementation of `[Typed]Func::call_async` which made it capable of calling async-ty…
- CVE-2026-27204MEDIUMCVSS 6.5EG 6.5fixed in 24.0.6, 36.0.6, 40.0.4 or 41.0.4, by version range2026-02-24
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not ap…
- CVE-2026-27572HIGHCVSS 7.5EG 7.5fixed in 24.0.6, 36.0.6, 40.0.4 or 41.0.4, by version range2026-02-24
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:http/types.fields` resource is susceptible to panics when too many fields are added to the set of h…
- CVE-2026-34941HIGHCVSS 8.1EG 8.1fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byt…
- CVE-2026-34942MEDIUMCVSS 6.5EG 6.5fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocate…
- CVE-2026-34943HIGHCVSS 7.5EG 7.5fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the se…
- CVE-2026-34944MEDIUMCVSS 5.7EG 5.7fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is neces…
- CVE-2026-34945MEDIUMCVSS 6.5EG 6.5fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size ins…
- CVE-2026-34946HIGHCVSS 7.5EG 7.5fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a v…
- CVE-2026-34971HIGHCVSS 7.8EG 7.8fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address…
- CVE-2026-34983MEDIUMCVSS 5.0EG 5.0fixed in 43.0.12026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder…
- CVE-2026-34987CRITICALCVSS 9.9EG 9.9fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-…
- CVE-2026-34988MEDIUMCVSS 6.3EG 6.3fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one…
- CVE-2026-35186HIGHCVSS 7.5EG 7.5fixed in 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit table…
- CVE-2026-35195MEDIUMCVSS 5.4EG 5.4fixed in 24.0.7, 36.0.7, 42.0.2 or 43.0.1, by version range2026-04-09
vulnerable: 43.0.0
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated b…
- CVE-2026-44216HIGHCVSS 7.5EG 7.5fixed in 36.0.8, 43.0.2 or 44.0.1, by version range2026-05-14
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus p…
Check whether wasmtime is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for wasmtime CVEs against the assets you own.
Book a Demo →