Every CVE Search/ Get API key

CVE-2026-34943

Wasmtime panics when lifting `flags` component value

5.6 MediumFix available

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.34%Up 0.3 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.6

Wasmtime panics when lifting `flags` component value

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34943
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-248
Updated
2026-11-02
EUVDEUVD-2026-21022 5.6

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
EUVD-2026-21022
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m758-wjhj-p3jq 5.6

Wasmtime has a possible panic when lifting `flags` component value

Impact

Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface.

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using wasmtime::component::Val and possibly work with a flags type in the component model.

Record
GHSA-m758-wjhj-p3jq
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
NVD 5.6

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34943
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSV 5.6

Wasmtime panics when lifting `flags` component value

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34943
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-248
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34943 7.5

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
DEBIAN-CVE-2026-34943
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-m758-wjhj-p3jq 5.6

Wasmtime has a possible panic when lifting `flags` component value

Impact

Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface.

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using wasmtime::component::Val and possibly work with a flags type in the component model.

Record
GHSA-m758-wjhj-p3jq
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVJLSEC-2026-1356 5.6

Wasmtime has a possible panic when lifting `flags` component value

Impact

Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface.

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using wasmtime::component::Val and possibly work with a flags type in the component model.

Record
JLSEC-2026-1356
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRUSTSEC-2026-0085 5.6

Panic when lifting `flags` component value

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq For more information see the GitHub-hosted security advisory.

Record
RUSTSEC-2026-0085
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34943 5.6

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
UBUNTU-CVE-2026-34943
CVSS 4.0
5.6 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10715-1 No score

libtree-sitter0_26-0.26.8-2.1 on GA media

These are all security issues fixed in the libtree-sitter0_26-0.26.8-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10715-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20749-1 No score

Security update for tree-sitter

This update for tree-sitter fixes the following issues

Security issues:

  • CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
  • CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
  • CVE-2026-34943: wasmtime: lifting flags component value can lead to a denial of service (bsc#1261954).
  • CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
  • CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
  • CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
  • CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
  • CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
  • CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
  • CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).

Changes for tree-sitter:

  • update to 0.26.8:
  • fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @WillLillis in #5465
  • perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
Record
openSUSE-SU-2026:20749-1
Updated
2026-11-02
OSVSUSE-SU-2026:21789-1 No score

Security update for tree-sitter

This update for tree-sitter fixes the following issues

Security issues:

  • CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
  • CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
  • CVE-2026-34943: wasmtime: lifting flags component value can lead to a denial of service (bsc#1261954).
  • CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
  • CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
  • CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
  • CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
  • CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
  • CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
  • CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).

Changes for tree-sitter:

  • update to 0.26.8:
  • fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @WillLillis in #5465
  • perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
Record
SUSE-SU-2026:21789-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wasmtime
crates.io
 before 24.0.7
24.0.7
wasmtime
crates.io
 25.0.0 up to 36.0.7
36.0.7
wasmtime
crates.io
 37.0.0 up to 42.0.2
42.0.2
wasmtime
crates.io
 43.0.0 to 43.0.0
43.0.1
rust-wasmtime
Debian:13
 All versions, plus listed versions
26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6
Show 38 moreShow less
26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.11+dfsg-136.0.12+dfsg-136.0.12+dfsg-236.0.12+dfsg-336.0.13+dfsg-136.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-736.0.7+dfsg-136.0.8+dfsg-136.0.9+dfsg-136.0.9+dfsg-2
 None known
rust-wasmtime
Debian:14
 before 36.0.7+dfsg-1, plus listed versions
26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6
Show 29 moreShow less
26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-7
36.0.7+dfsg-1
wasmtime
crates.io
 43.0.0 up to 43.0.1
43.0.1
Wasmtime_jll
Julia
 before 45.0.1+0
45.0.1+0
wasmtime
crates.io
 0.0.0-0 up to 24.0.7, 25.0.0 up to 36.0.7, 37.0.0 up to 42.0.2, 43.0.0 up to 43.0.1
24.0.736.0.742.0.243.0.1
rust-wasmtime
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
rust-wasmtime
Ubuntu:25.10
 All versions, plus listed versions
26.0.1+dfsg-3
 None known
rust-wasmtime
Ubuntu:26.10
 All versions, plus listed versions
36.0.5+dfsg-136.0.13+dfsg-1
 None known
rust-wasmtime
Ubuntu:26.04:LTS
 All versions, plus listed versions
26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1
 None known
tree-sitter
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.26.8-2.1
0.26.8-2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34943 is a medium vulnerability (CVSS 5.6) in Bytecodealliance Wasmtime, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in wasmtime 24.0.7.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open