WA
Product
wasmtime
61
CVEs
0
On KEV
10.0
Max CVSS
19
New 30D
Severity mix
Critical 8High 16Medium 29Low 8
Watch
Add wasmtime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58494 | 6.5 | Jul 8 | Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination Affected: < 24.0.11; >= 25.0.0, < 36.0.12; >= 37.0.0, < 45.0.3; >= 46.0.0, < 46.0.1 |
| CVE-2026-34945 | 6.5 | Apr 9 | Wasmtime leaks host data with 64-bit tables and Winch Affected: >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-34942 | 6.5 | Apr 9 | Wasmtime panics when transcoding misaligned utf-16 strings Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2026-27204 | 6.5 | Feb 24 | Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion Affected: < 24.0.6; >= 25.0.0, < 36.0.6; >= 37.0.0, < 40.0.4; >= 41.0.0, < 41.0.4 |
| CVE-2026-34988 | 6.3 | Apr 9 | Wasmtime leaks data between pooling allocator instances Affected: >= 28.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2021-39218 | 6.3 | Sep 17 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: 0.26.0 before 0.30.0 |
| CVE-2021-39219 | 6.3 | Sep 17 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: before 0.30.0 |
| CVE-2021-39216 | 6.3 | Sep 17 | Wasmtime is an open source runtime for WebAssembly & WASI Affected: 0.19.0 before 0.30.0 |
| CVE-2026-115388 New | 6.2 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-115387 New | 6.2 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow Affected: before 36.0.16; 37.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-115385 New | 6.2 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115391 New | 5.8 | Oct 22 | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams Affected: 46.0.0 before 46.0.3; 47.0.0 before 47.0.4 |
| CVE-2026-115892 New | 5.7 | Oct 23 | Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type Affected: >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4 |
| CVE-2026-115390 New | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS Affected: 47.0.0 before 48.0.3; 49.0.0 before 49.0.1 |
| CVE-2026-115379 New | 5.7 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call Affected: 47.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-34944 | 5.7 | Apr 9 | Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2022-31104 | 5.6 | Jun 28 | Wasmtime is a standalone runtime for WebAssembly Affected: before 0.38.1 |
| CVE-2026-24116 | 5.5 | Jan 27 | Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 Affected: >= 29.0.0, < 36.0.5; >= 37.0.0, < 40.0.3; = 41.0.0 |
| CVE-2024-47763 | 5.5 | Oct 9 | Wasmtime is an open source runtime for WebAssembly Affected: 21.0.0; 21.0.1; 22.0.0; 23.0.0; 23.0.1; 23.0.2; +3 more |
| CVE-2024-30266 | 5.5 | Apr 4 | wasmtime is a runtime for WebAssembly Affected: 19.0.0 |
| CVE-2026-35195 | 5.4 | Apr 9 | Wasmtime has an out-of-bounds write or crash when transcoding component model strings Affected: < 24.0.7; >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, < 44.0.1 |
| CVE-2023-41880 | 5.3 | Sep 15 | Wasmtime is a standalone runtime for WebAssembly Affected: 10.0.0 before 10.0.2; 11.0.0 before 11.0.2; 12.0.0 before 12.0.2 |
| CVE-2026-54786 | 5.0 | Jul 1 | Wasmtime: Leak in WASIp1 `fd_renumber` implementation Affected: < 24.0.10; >= 25.0.0, < 36.0.11; >= 37.0.0, < 44.0.3; >= 45.0.0, < 45.0.2 |
| CVE-2026-34983 | 5.0 | Apr 9 | Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` Affected: >= 43.0.0, < 43.0.1 |
| CVE-2026-115383 New | 4.8 | Oct 22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports Affected: 47.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115382 New | 4.8 | Oct 22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS Affected: 46.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2026-115381 New | 4.8 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
| CVE-2023-27477 | 4.3 | Mar 8 | wasmtime is a fast and secure runtime for WebAssembly Affected: 0.37.0 before 4.0.1; 5.0.0; 6.0.0 |
| CVE-2026-115380 New | 4.0 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff Affected: before 36.0.17; 37.0.0 before 48.0.4; 49.0.0 before 49.0.2 |
Showing 29