bytecodealliance wasmtime

• CVE-2026-121441 Low 3.7 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling 0.2%
• CVE-2026-121440 Low 3.7 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass 0.2%
• CVE-2026-121439 Medium 5.3 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http 0.2%
• CVE-2026-119143 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 0.2%
• CVE-2026-119142 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop 0.3%
• CVE-2026-119141 Medium 5.3 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc 0.4%
• CVE-2026-119140 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield 0.2%
• CVE-2026-119139 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call 0.2%
• CVE-2026-119138 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap 0.3%
• CVE-2026-119137 Medium 5.3 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry 0.4%
• CVE-2026-119136 Medium 4.8 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass 0.2%
• CVE-2026-119135 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch 0.2%
• CVE-2026-119134 Medium 6.2 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles 0.2%
• CVE-2026-119133 Low 2.6 Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags 0.2%
• CVE-2026-119132 Medium 4.8 Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter 0.2%
• CVE-2026-119131 Medium 5.3 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http 0.3%
• CVE-2026-119130 Low 2.6 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling 0.2%
• CVE-2026-118688 High 7.9 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename 0.2%
• CVE-2026-115893 Critical 9.9 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 1.0%
• CVE-2026-115892 Medium 5.7 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type 0.4%
• CVE-2026-115889 Critical 9.9 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 0.5%
• CVE-2026-115393 Low 3.8 Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion <0.1%
• CVE-2026-115392 High 7.9 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes 0.2%
• CVE-2026-115391 Medium 5.8 Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams 0.2%
• CVE-2026-115390 Medium 5.7 Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS 0.2%
• CVE-2026-115389 Low 2.3 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API 0.2%
• CVE-2026-115388 Medium 6.2 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write 0.1%
• CVE-2026-115387 Medium 6.2 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow 0.1%
• CVE-2026-115386 Low 2.6 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir 0.2%
• CVE-2026-115385 Medium 6.2 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps 0.1%
• CVE-2026-115384 Critical 9.9 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow 0.3%
• CVE-2026-115383 Medium 4.8 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports 0.2%
• CVE-2026-115382 Medium 4.8 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS 0.3%
• CVE-2026-115381 Medium 4.8 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes 0.2%
• CVE-2026-115380 Medium 4.0 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff 0.1%
• CVE-2026-115379 Medium 5.7 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call 0.3%
• CVE-2026-104855 Low 2.0 Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state 0.3%
• CVE-2026-58494 Medium 6.5 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination 0.2%
• CVE-2026-54786 Low 2.3 Wasmtime: Leak in WASIp1 `fd_renumber` implementation 0.4%
• CVE-2026-47261 High 7.5 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction 0.4%
• CVE-2026-44216 High 7.5 Wasmtime: Panic when allocating a table exceeding the size of the host's address space 0.3%
• CVE-2026-35195 Medium 6.1 Wasmtime has an out-of-bounds write or crash when transcoding component model strings 0.2%
• CVE-2026-35186 High 7.5 Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend 0.2%
• CVE-2026-34988 Low 2.3 Wasmtime leaks data between pooling allocator instances 0.3%
• CVE-2026-34987 Critical 9.0 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access 0.3%
• CVE-2026-34983 Low 1.0 Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` 0.1%
• CVE-2026-34971 High 7.8 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift 0.3%
• CVE-2026-34946 Medium 5.9 Wasmtime's host panics when Winch compiler executes `table.fill` 0.4%
• CVE-2026-34945 Low 2.3 Wasmtime leaks host data with 64-bit tables and Winch 0.3%
• CVE-2026-34944 Medium 4.1 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 0.2%