Skip to content
Bytecodealliance Wasmtime vulnerabilities
-
bytecodealliance wasmtime
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling
CVE-2026-121441
Fix available
6.3 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass
CVE-2026-121440
Fix available
6.3 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http
CVE-2026-121439
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
CVE-2026-115893
Public exploitFix available
9.9 Critical
-
bytecodealliance wasmtime
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115892
Fix available
5.7 Medium
-
bytecodealliance wasmtime
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
CVE-2026-115889
Public exploitFix available
9.9 Critical
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-119143
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
CVE-2026-119142
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-119141
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-119140
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
CVE-2026-119139
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
CVE-2026-119138
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-119137
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-119136
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch
CVE-2026-119135
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles
CVE-2026-119134
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags
CVE-2026-119133
Fix available
2.1 Low
-
bytecodealliance wasmtime
Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-119132
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-119131
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
CVE-2026-119130
Fix available
2.1 Low
-
bytecodealliance wasmtime
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename
CVE-2026-118688
Fix available
8.8 High
-
bytecodealliance wasmtime
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
CVE-2026-115386
Fix available
2.1 Low
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
CVE-2026-115385
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
CVE-2026-115384
Fix available
9.4 Critical
-
bytecodealliance wasmtime
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
CVE-2026-115383
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
CVE-2026-115382
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
CVE-2026-115381
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
CVE-2026-115380
Fix available
5.1 Medium
-
bytecodealliance wasmtime
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
CVE-2026-115379
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
CVE-2026-115390
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
CVE-2026-115389
Fix available
1.0 Low
-
bytecodealliance wasmtime
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write
CVE-2026-115388
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow
CVE-2026-115387
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
CVE-2026-115392
Fix available
8.8 High
-
bytecodealliance wasmtime
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
CVE-2026-115391
Fix available
6.9 Medium
-
bytecodealliance wasmtime
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion
CVE-2026-115393
Fix available
1.0 Low
-
bytecodealliance wasmtime
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
CVE-2026-104855
Fix available
2.0 Low
-
bytecodealliance wasmtime
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
CVE-2026-58494
Fix available
6.5 Medium
-
bytecodealliance wasmtime
Wasmtime: Leak in WASIp1 `fd_renumber` implementation
CVE-2026-54786
Fix available
2.3 Low
-
bytecodealliance wasmtime
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
CVE-2026-47261
Fix available
7.5 High
-
bytecodealliance wasmtime, red hat enterprise linux 10, hardened images +2 more
Wasmtime: Panic when allocating a table exceeding the size of the host's address space
CVE-2026-44216
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime has an out-of-bounds write or crash when transcoding component model strings
CVE-2026-35195
Fix available
6.1 Medium
-
bytecodealliance wasmtime
Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend
CVE-2026-35186
Fix available
6.1 Medium
-
bytecodealliance wasmtime
Wasmtime leaks data between pooling allocator instances
CVE-2026-34988
Fix available
2.3 Low
-
bytecodealliance wasmtime
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
CVE-2026-34987
Fix available
9.0 Critical
-
bytecodealliance wasmtime
Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`
CVE-2026-34983
Fix available
1.0 Low
-
bytecodealliance wasmtime, red hat connectivity link 1, enterprise linux 10 +2 more
Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
CVE-2026-34971
Fix available
9.0 Critical
-
bytecodealliance wasmtime
Wasmtime's host panics when Winch compiler executes `table.fill`
CVE-2026-34946
Fix available
5.9 Medium
-
bytecodealliance wasmtime
Wasmtime leaks host data with 64-bit tables and Winch
CVE-2026-34945
Fix available
2.3 Low
-
bytecodealliance wasmtime
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
CVE-2026-34944
Fix available
4.1 Medium
- Show olderLoading…