Skip to contentBytecodealliance vulnerabilities
Newest
- bytecodealliance wasmtimeWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instanceCVE-2026-27572Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionCVE-2026-27204Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` futureCVE-2026-27195Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64CVE-2026-24116Fix available4.1 Medium
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreWebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcodeCVE-2025-647135.1 Medium
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreWebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instructionCVE-2025-647044.7 Medium
- bytecodealliance wasmtimeWasmtime provides unsound API access to a WebAssembly shared linear memoryCVE-2025-64345Fix available1.8 Low
- bytecodealliance wasmtimeWasmtime has memory leak in C API with `externref` and `anyref` typesCVE-2025-61670Fix available1.0 Low
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreWAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT modeCVE-2025-58749Fix available2.1 Low
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreWebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specifiedCVE-2025-54126Fix available6.9 Medium
- bytecodealliance wasmtimeWasmtime vulnerable to segfault when using component resourcesCVE-2025-62711Fix available2.1 Low
- bytecodealliance wasmtimeWasmtime has host panic with `fd_renumber` WASIp1 functionCVE-2025-53901Fix available3.5 Low
- bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 moreiwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi featureCVE-2025-438537.0 High
- bytecodealliance webassembly micro runtimewasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer...CVE-2024-27532Fix available7.5 High
- bytecodealliance webassembly micro runtimeAn issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f...CVE-2024-25431Fix available7.8 High
- bytecodealliance cap-stdcap-std doesn't fully sandbox all the Windows device filenamesCVE-2024-51756Fix available2.3 Low
- bytecodealliance wasmtimeWasmtime doesn't fully sandbox all the Windows device filenamesCVE-2024-51745Fix available2.3 Low
- bytecodealliance wasmtimeWasmtime race condition could lead to WebAssembly control-flow integrity and type safety violationsCVE-2024-47813Fix available2.9 Low
- bytecodealliance wasmtimeWasmtime runtime crash when combining tail calls with trapping importsCVE-2024-47763Fix available5.5 Medium
- bytecodealliance wasm micro runtime, webassembly micro runtime +1 moreAn out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime...CVE-2024-342517.5 High
- bytecodealliance wasm micro runtime, webassembly micro runtime +1 moreA heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0...CVE-2024-34250Fix available6.2 Medium
- bytecodealliance wasmtimeWasmtime vulnerable to panic when using a dropped extenref-typed element segmentCVE-2024-30266Fix available3.3 Low
- bytecodealliance webassembly micro runtimeBytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can...CVE-2023-52284Fix available5.5 Medium
- bytecodealliance webassembly micro runtimeAn heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3...CVE-2023-48105Fix available7.5 High
- bytecodealliance rustix`rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosionCVE-2024-43806Fix available6.5 Medium
- bytecodealliance wasmtimeMiscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64CVE-2023-41880Fix available2.2 Low
- bytecodealliance wasmtimeWasmtime has Undefined Behavior in Rust runtime functionsCVE-2023-30624Fix available3.9 Low
- bytecodealliance wasmtime, cranelift-codegen +1 morewasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64CVE-2023-27477Fix available3.1 Low
- bytecodealliance wasmtime, cranelift-codegen +1 moreGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeCVE-2023-26489Fix available10.0 Critical
- bytecodealliance wasmtimewasmtime_trap_code C API function has out of bounds write vulnerabilityCVE-2022-39394Fix available3.8 Low
- bytecodealliance wasmtimeWasmtime vulnerable to data leakage between instances in the pooling allocatorCVE-2022-39393Fix available8.6 High
- bytecodealliance wasmtimeWasmtime vulnerable to out of bounds read/write with zero-memory-pages configurationCVE-2022-39392Fix available5.9 Medium
- bytecodealliance wasmtime, cranelift-codegen +1 moreUse After Free in WasmtimeCVE-2022-31146Fix available6.4 Medium
- bytecodealliance cranelift-codegen, wasmtime +1 moreMiscompilation of `i8x16.swizzle` and `select` with v128 inputs in WasmtimeCVE-2022-31104Fix available4.8 Medium
- bytecodealliance wasmtimeUse after free in WasmtimeCVE-2022-24791Fix available8.1 High
- bytecodealliance cranelift-codegen, wasmtime +1 moreCranelift vulnerable to miscompilation of constant values in division on AArch64CVE-2022-31169Fix available5.9 Medium
- bytecodealliance wasmtimeInvalid drop of partially-initialized instances in wasmtimeCVE-2022-23636Public exploitFix available5.1 Medium
- bytecodealliance lucetUse After Free in lucetCVE-2021-437908.5 High
- bytecodealliance wasmtime, fedoraproject fedora +1 moreWrong type for `Linker`-define functions when used across two `Engine`sCVE-2021-39219Fix available6.3 Medium
- bytecodealliance wasmtime, fedoraproject fedora +1 moreOut-of-bounds read/write and invalid free with `externref`s and GC safepoints in WasmtimeCVE-2021-39218Fix available6.3 Medium
- bytecodealliance wasmtime, fedoraproject fedora +1 moreUse after free passing `externref`s to Wasm in WasmtimeCVE-2021-39216Fix available6.3 Medium
- bytecodealliance wasmtime, cranelift-codegen +1 moreMemory access due to code generation flaw in Cranelift moduleCVE-2021-32629Fix available7.2 High