{"id":"CVE-2026-34943","aliases":["DEBIAN-CVE-2026-34943","EUVD-2026-21022","GHSA-m758-wjhj-p3jq","JLSEC-2026-1356","RUSTSEC-2026-0085","SUSE-SU-2026:21789-1","UBUNTU-CVE-2026-34943","openSUSE-SU-2026:10715-1","openSUSE-SU-2026:20749-1"],"status":"published","title":"Wasmtime panics when lifting `flags` component value","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","severity":{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00336,"percentile":0.27336,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2026-04-09T12:00:00Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"crates.io","package":"wasmtime","fixed_in":["24.0.7","36.0.7","42.0.2","43.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-wasmtime","fixed_in":["36.0.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Wasmtime_jll","fixed_in":["45.0.1+0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.7"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"36.0.7"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"37.0.0"},{"fixed":"42.0.2"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"43.0.0"},{"last_affected":"43.0.0"},{"fixed":"43.0.1"}]}],"versions":["43.0.0"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-10","26.0.1+dfsg-3","26.0.1+dfsg-4","26.0.1+dfsg-5","26.0.1+dfsg-6","26.0.1+dfsg-7","26.0.1+dfsg-8","26.0.1+dfsg-9","27.0.0+dfsg-2","27.0.0+dfsg-3","27.0.0+dfsg-4","28.0.1+dfsg-1","28.0.1+dfsg-2","28.0.1+dfsg-3","29.0.1+dfsg-1","29.0.1+dfsg-2","29.0.1+dfsg-3","29.0.1+dfsg-4","29.0.1+dfsg-5","29.0.1+dfsg-6","29.0.1+dfsg-7","29.0.1+dfsg-8","36.0.11+dfsg-1","36.0.12+dfsg-1","36.0.12+dfsg-2","36.0.12+dfsg-3","36.0.13+dfsg-1","36.0.5+dfsg-1","36.0.5+dfsg-2","36.0.5+dfsg-3","36.0.5+dfsg-4","36.0.5+dfsg-5","36.0.6+dfsg-1","36.0.6+dfsg-2","36.0.6+dfsg-3","36.0.6+dfsg-4","36.0.6+dfsg-5","36.0.6+dfsg-6","36.0.6+dfsg-7","36.0.7+dfsg-1","36.0.8+dfsg-1","36.0.9+dfsg-1","36.0.9+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.0.7+dfsg-1"}]}],"versions":["26.0.1+dfsg-10","26.0.1+dfsg-3","26.0.1+dfsg-4","26.0.1+dfsg-5","26.0.1+dfsg-6","26.0.1+dfsg-7","26.0.1+dfsg-8","26.0.1+dfsg-9","27.0.0+dfsg-2","27.0.0+dfsg-3","27.0.0+dfsg-4","28.0.1+dfsg-1","28.0.1+dfsg-2","28.0.1+dfsg-3","29.0.1+dfsg-1","29.0.1+dfsg-2","29.0.1+dfsg-3","29.0.1+dfsg-4","29.0.1+dfsg-5","29.0.1+dfsg-6","29.0.1+dfsg-7","29.0.1+dfsg-8","36.0.5+dfsg-1","36.0.5+dfsg-2","36.0.5+dfsg-3","36.0.5+dfsg-4","36.0.5+dfsg-5","36.0.6+dfsg-1","36.0.6+dfsg-2","36.0.6+dfsg-3","36.0.6+dfsg-4","36.0.6+dfsg-5","36.0.6+dfsg-6","36.0.6+dfsg-7"]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"24.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"36.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"42.0.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"43.0.0"},{"fixed":"43.0.1"}]}],"versions":["43.0.0"]},{"source":"osv","ecosystem":"Julia","package":"Wasmtime_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"45.0.1+0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"wasmtime","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"24.0.7"},{"introduced":"25.0.0"},{"fixed":"36.0.7"},{"introduced":"37.0.0"},{"fixed":"42.0.2"},{"introduced":"43.0.0"},{"fixed":"43.0.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+dfsg-7","15.0.1+dfsg-4","16.0.0+dfsg-2","16.0.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["36.0.5+dfsg-1","36.0.13+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-wasmtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.0.1+dfsg-3","26.0.1+dfsg-4","28.0.1+dfsg-3","29.0.1+dfsg-5","36.0.5+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tree-sitter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.8-2.1"}]}],"bundled":4}],"products":[{"vendor":"bytecodealliance","product":"wasmtime"}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34943","tags":["advisory","web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0085.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m758-wjhj-p3jq","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34943.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34943","tags":["advisory"]},{"url":"https://github.com/bytecodealliance/wasmtime","tags":["package"]},{"url":"https://crates.io/crates/wasmtime","tags":["package"]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/13015","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621789-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259205","tags":["report"]},{"url":"https://bugzilla.suse.com/1261839","tags":["report"]},{"url":"https://bugzilla.suse.com/1261871","tags":["report"]},{"url":"https://bugzilla.suse.com/1261894","tags":["report"]},{"url":"https://bugzilla.suse.com/1261954","tags":["report"]},{"url":"https://bugzilla.suse.com/1261963","tags":["report"]},{"url":"https://bugzilla.suse.com/1261968","tags":["report"]},{"url":"https://bugzilla.suse.com/1261974","tags":["report"]},{"url":"https://bugzilla.suse.com/1262007","tags":["report"]},{"url":"https://bugzilla.suse.com/1262032","tags":["report"]},{"url":"https://bugzilla.suse.com/1262036","tags":["report"]},{"url":"https://bugzilla.suse.com/1262040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35195","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-34943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34943","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34943","title":"Wasmtime panics when lifting `flags` component value","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","status":"published","published":"2026-04-09T18:36:51.37Z","modified":"2026-04-13T20:15:23.994Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-21022","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","status":"published","published":"2026-04-09T18:36:51Z","modified":"2026-04-13T20:15:23Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:27.052992Z"}],"ghsa":[{"id":"GHSA-m758-wjhj-p3jq","title":"Wasmtime has a possible panic when lifting `flags` component value","description":"### Impact\n\nWasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. \n\nThis has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.\n\n### Patches\n\nWasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.\n\n### Workarounds\n\nThere is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.","status":"published","published":"2026-04-09T20:22:34Z","modified":"2026-04-24T21:03:44Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:39:57.650091Z"}],"nvd":[{"id":"CVE-2026-34943","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","status":"published","published":"2026-04-09T19:16:24.02Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-34943","title":"Wasmtime panics when lifting `flags` component value","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","status":"published","published":"2026-04-09T18:36:51.37Z","modified":"2026-10-28T02:30:50.132902551Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"DEBIAN-CVE-2026-34943","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","status":"published","published":"2026-04-09T19:16:24.02Z","modified":"2026-10-27T09:47:33.955364136Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-m758-wjhj-p3jq","title":"Wasmtime has a possible panic when lifting `flags` component value","description":"### Impact\n\nWasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. \n\nThis has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.\n\n### Patches\n\nWasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.\n\n### Workarounds\n\nThere is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.","status":"published","published":"2026-04-09T20:22:34Z","modified":"2026-09-10T03:51:02.309749704Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"JLSEC-2026-1356","title":"Wasmtime has a possible panic when lifting `flags` component value","description":"### Impact\n\nWasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface.\n\nThis has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.\n\n### Patches\n\nWasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.\n\n### Workarounds\n\nThere is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.","status":"published","published":"2026-08-21T20:43:33.133Z","modified":"2026-08-21T21:14:21.931266537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RUSTSEC-2026-0085","title":"Panic when lifting `flags` component value","description":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq\nFor more information see the GitHub-hosted security advisory.","status":"published","published":"2026-04-09T12:00:00Z","modified":"2026-10-12T18:00:09.239209732Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-34943","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","status":"published","published":"2026-04-09T19:16:00Z","modified":"2026-10-17T13:00:02.508902683Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"openSUSE-SU-2026:10715-1","title":"libtree-sitter0_26-0.26.8-2.1 on GA media","description":"These are all security issues fixed in the libtree-sitter0_26-0.26.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-06T00:00:00Z","modified":"2026-05-07T08:47:38.961758Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20749-1","title":"Security update for tree-sitter","description":"This update for tree-sitter fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).\n- CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).\n- CVE-2026-34943: wasmtime: lifting `flags` component value can lead to a denial of service (bsc#1261954).\n- CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service\n  (bsc#1261963).\n- CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).\n- CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).\n- CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).\n- CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).\n- CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).\n- CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).\n\nChanges for tree-sitter:\n\n- update to 0.26.8:\n\n * fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in\n #5448\n * fix(lib): document invariants that must be upheld for TSInputEdit by\n @WillLillis in #5452\n * fix(cli): correct typo in parse command's help text by @WillLillis in #5465\n * perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476\n * Fix wasm loading of languages w/ multiple reserved word sets by\n @tree-sitter-ci-bot[bot] in #5477\n * generate: avoid panicking when a supertype only has hidden external token\n children by @tree-sitter-ci-bot[bot] in #5478\n","status":"published","published":"2026-05-14T08:07:53Z","modified":"2026-05-19T18:23:48.124613698Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21789-1","title":"Security update for tree-sitter","description":"This update for tree-sitter fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).\n- CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).\n- CVE-2026-34943: wasmtime: lifting `flags` component value can lead to a denial of service (bsc#1261954).\n- CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service\n  (bsc#1261963).\n- CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).\n- CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).\n- CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).\n- CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).\n- CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).\n- CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).\n\nChanges for tree-sitter:\n\n- update to 0.26.8:\n\n * fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in\n #5448\n * fix(lib): document invariants that must be upheld for TSInputEdit by\n @WillLillis in #5452\n * fix(cli): correct typo in parse command's help text by @WillLillis in #5465\n * perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476\n * Fix wasm loading of languages w/ multiple reserved word sets by\n @tree-sitter-ci-bot[bot] in #5477\n * generate: avoid panicking when a supertype only has hidden external token\n children by @tree-sitter-ci-bot[bot] in #5478\n","status":"published","published":"2026-05-14T08:09:11Z","modified":"2026-05-28T18:24:08.686123956Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}