wasmtime vulnerabilities (crates.io)
66 vulnerabilities.
-
wasmtimecrates.io Cross-engine type confusion with host-created struct-types-with-supertypes No score -
wasmtimecrates.io Unchecked memory usage in transferring borrowed resources between components No score -
wasmtimecrates.io Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check 1.8 Low -
wasmtimecrates.io Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 9.9 Critical -
wasmtimecrates.io Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type 5.7 Medium -
wasmtimecrates.io Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 9.9 Critical -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 5.9 Medium -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop 5.9 Medium -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc 6.9 Medium -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield 5.9 Medium -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call 5.9 Medium -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap 5.9 Medium -
wasmtimecrates.io Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry 6.9 Medium -
wasmtimecrates.io Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass 5.9 Medium -
wasmtimecrates.io Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch 5.9 Medium -
wasmtimecrates.io Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles 6.9 Medium -
wasmtimecrates.io Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags 2.1 Low -
wasmtimecrates.io Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter 5.9 Medium -
wasmtimecrates.io Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow 9.4 Critical -
wasmtimecrates.io Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports 5.9 Medium -
wasmtimecrates.io Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call 6.9 Medium -
wasmtimecrates.io Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS 6.9 Medium -
wasmtimecrates.io Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API 1.0 Low -
wasmtimecrates.io Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes 8.8 High -
wasmtimecrates.io Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams 6.9 Medium -
wasmtimecrates.io Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion 1.0 Low -
wasmtimecrates.io Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state 2.0 Low -
wasmtimecrates.io Wasmtime: Panic when allocating a table exceeding the size of the host's address space 5.9 Medium -
wasmtimecrates.io Wasmtime has an out-of-bounds write or crash when transcoding component model strings 6.1 Medium -
wasmtimecrates.io Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend 6.1 Medium -
wasmtimecrates.io Wasmtime leaks data between pooling allocator instances 2.3 Low -
wasmtimecrates.io Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access 9.0 Critical -
wasmtimecrates.io Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` 1.0 Low -
wasmtimecrates.io Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift 9.0 Critical -
wasmtimecrates.io Wasmtime's host panics when Winch compiler executes `table.fill` 5.9 Medium -
wasmtimecrates.io Wasmtime leaks host data with 64-bit tables and Winch 2.3 Low -
wasmtimecrates.io Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 4.1 Medium -
wasmtimecrates.io Wasmtime panics when lifting `flags` component value 5.6 Medium -
wasmtimecrates.io Wasmtime panics when transcoding misaligned utf-16 strings 5.9 Medium -
wasmtimecrates.io Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding 6.9 Medium -
wasmtimecrates.io Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance 6.9 Medium -
wasmtimecrates.io Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion 6.9 Medium -
wasmtimecrates.io Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future 6.9 Medium -
wasmtimecrates.io Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 4.1 Medium -
wasmtimecrates.io Wasmtime provides unsound API access to a WebAssembly shared linear memory 1.8 Low -
wasmtimecrates.io Wasmtime vulnerable to segfault when using component resources 2.1 Low -
wasmtimecrates.io Wasmtime has host panic with `fd_renumber` WASIp1 function 3.5 Low -
wasmtimecrates.io Wasmtime doesn't fully sandbox all the Windows device filenames 2.3 Low -
wasmtimecrates.io Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations 2.9 Low -
wasmtimecrates.io Wasmtime runtime crash when combining tail calls with trapping imports 5.5 Medium - Show olderLoading…