WA
Product
wasmtime
63
CVEs
0
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 8High 17Medium 29Low 9
Watch
Add wasmtime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115382 New | 4.8 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115381 New | 4.8 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2023-27477 | 4.3 | Mar 8 | wasmtime is a fast and secure runtime for WebAssembly Affected: 0.37.0 before 4.0.1; 5.0.0; 6.0.0 |
| CVE-2026-115380 New | 4.0 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115393 New | 3.8 | Oct 22 | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion Affected: before 24.0.12; 25.0.0 before 36.0.13; 37.0.0 before 46.0.2; 47.0.0 before 47.0.3 |
| CVE-2025-53901 | 3.5 | Jul 18 | Wasmtime has host panic with `fd_renumber` WASIp1 function Affected: < 24.0.4; >= 33.0.0, < 33.0.2; >= 34.0.0, < 34.0.2 |
| CVE-2025-61670 | 3.3 | Oct 7 | Wasmtime has memory leak in C API with `externref` and `anyref` types Affected: >= 37.0.0, < 37.0.2 |
| CVE-2025-62711 | 3.1 | Oct 24 | Wasmtime vulnerable to segfault when using component resources Affected: >= 38.0.0, < 38.0.3 |
| CVE-2024-47813 | 2.9 | Oct 9 | Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations Affected: >= 19.0.0, < 21.0.2; >= 22.0.0, < 22.0.1; >= 23.0.0, < 23.0.3; >= 24.0.0, < 24.0.1; >= 25.0.0, < 25.0.2 |
| CVE-2026-115386 New | 2.6 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115389 New | 2.3 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-104855 | 2.0 | Oct 2 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state Affected: >= 46.0.0, < 46.0.2; >= 47.0.0, < 47.0.3 |
| CVE-2025-64345 | 1.8 | Nov 12 | Wasmtime provides unsound API access to a WebAssembly shared linear memory Affected: >= 38.0.1, < 38.0.4; >= 37.0.0, < 37.0.3; >= 26.0.0, < 36.0.3; < 24.0.5 |