WA
Product
wasmtime
77
CVEs
0
On KEV
10.0
Max CVSS
34
New 30D
Severity mix
Critical 8High 17Medium 41Low 11
Watch
Add wasmtime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58494 | 6.5 | Jul 8 | Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination Affected: < 24.0.11; >= 25.0.0, < 36.0.12; >= 37.0.0, < 45.0.3; >= 46.0.0, < 46.0.1 |
| CVE-2026-34945 | 6.5 | Apr 9 | Wasmtime leaks host data with 64-bit tables and Winch Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-34942 | 6.5 | Apr 9 | Wasmtime panics when transcoding misaligned utf-16 strings Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-27204 | 6.5 | Feb 24 | Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion Affected: < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4; >= 41.0.0, < 41.0.4 |
| CVE-2026-34988 | 6.3 | Apr 9 | Wasmtime leaks data between pooling allocator instances Affected: >= 28.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2021-39218 | 6.3 | Sep 17 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: 0.26.0 before 0.30.0 |
| CVE-2021-39219 | 6.3 | Sep 17 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: before 0.30.0 |
| CVE-2021-39216 | 6.3 | Sep 17 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: 0.19.0 before 0.30.0 |
| CVE-2026-119134 New | 6.2 | Oct 29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles Affected: before 36.0.18; 37.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-115388 New | 6.2 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-115387 New | 6.2 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-115385 New | 6.2 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115391 New | 5.8 | Oct 22 | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams Affected: 46.0.0 before 46.0.3; 47.0.0 before 47.0.4 |
| CVE-2026-115892 New | 5.7 | Oct 23 | Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type Affected: >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 |
| CVE-2026-115390 New | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS Affected: 47.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-115379 New | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call Affected: 47.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-34944 | 5.7 | Apr 9 | Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2022-31104 | 5.6 | Jun 28 | Wasmtime is a standalone runtime for WebAssembly Affected: before 0.38.1 |
| CVE-2026-24116 | 5.5 | Jan 27 | Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 Affected: >= 29.0.0, < 36.0.5; >= 37.0.0, < 40.0.3; = 41.0.0 |
| CVE-2024-47763 | 5.5 | Oct 9 | Wasmtime runtime crash when combining tail calls with trapping imports Affected: >= 21.0.0, < 21.0.2; >= 22.0.0, < 22.0.1; >= 23.0.0, < 23.0.3; >= 24.0.0, < 24.0.1; >= 25.0.0, < 25.0.2 |
| CVE-2024-30266 | 5.5 | Apr 4 | Wasmtime vulnerable to panic when using a dropped extenref-typed element segment Affected: = 19.0.0 |
| CVE-2026-35195 | 5.4 | Apr 9 | Wasmtime has an out-of-bounds write or crash when transcoding component model strings Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-119141 New | 5.3 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119137 New | 5.3 | Oct 29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry Affected: 42.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119131 New | 5.3 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2023-41880 | 5.3 | Sep 15 | Wasmtime is a standalone runtime for WebAssembly Affected: 10.0.0 before 10.0.2; 11.0.0 before 11.0.2; 12.0.0 before 12.0.2 |
| CVE-2026-54786 | 5.0 | Jul 1 | Wasmtime: Leak in WASIp1 `fd_renumber` implementation Affected: < 24.0.10; >= 25.0.0, < 36.0.11; >= 37.0.0, < 44.0.3; >= 45.0.0, < 45.0.2 |
| CVE-2026-34983 | 5.0 | Apr 9 | Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` Affected: >= 43.0.0, < 43.0.1 |
| CVE-2026-119143 New | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119142 New | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119140 New | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119139 New | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119138 New | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119136 New | 4.8 | Oct 29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass Affected: 42.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119135 New | 4.8 | Oct 29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch Affected: 46.0.0 before 48.0.6; 49.0.0 before 49.0.3 |
| CVE-2026-119132 New | 4.8 | Oct 29 | Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter Affected: 49.0.0 before 49.0.3 |
| CVE-2026-115383 New | 4.8 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports Affected: 47.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115382 New | 4.8 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115381 New | 4.8 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2023-27477 | 4.3 | Mar 8 | wasmtime is a fast and secure runtime for WebAssembly Affected: 0.37.0 before 4.0.1; 5.0.0; 6.0.0 |
| CVE-2026-115380 New | 4.0 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
Showing 41