wasmtime vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-44216Mediumwasmtime: wasmtime has a panic when allocating a table exceeding the size of the host's address space CVE-2026-35186Mediumwasmtime: Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend CVE-2026-34987Criticalwasmtime: Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVE-2026-35195Mediumwasmtime: Wasmtime has out-of-bounds write or crash when transcoding component model strings CVE-2026-34988Lowwasmtime: Wasmtime has data leakage between pooling allocator instances CVE-2026-34983Lowwasmtime: Wasmtime has use-after-free bug after cloning `wasmtime::Linker`CVE-2026-34971Criticalwasmtime: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift CVE-2026-34946Mediumwasmtime: Wasmtime has host panic when Winch compiler executes `table.fill`CVE-2026-34945Lowwasmtime: Wasmtime has host data leakage with 64-bit tables and Winch CVE-2026-34944Mediumwasmtime: Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 CVE-2026-34943Mediumwasmtime: Wasmtime has a possible panic when lifting `flags` component value CVE-2026-34942Mediumwasmtime: Wasmtime: Panic when transcoding misaligned utf-16 strings CVE-2026-34941Mediumwasmtime: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding CVE-2026-27572Mediumwasmtime: Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance CVE-2026-27204Mediumwasmtime: Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion CVE-2026-27195Mediumwasmtime: Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVE-2026-24116Mediumwasmtime: Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 CVE-2025-64345Lowwasmtime: Wasmtime provides unsound API access to a WebAssembly shared linear memory CVE-2025-62711Lowwasmtime: Wasmtime vulnerable to segfault when using component resources CVE-2025-53901Lowwasmtime-wasi: Wasmtime CLI is vulnerable to host panic through its fd_renumber function CVE-2024-51745Lowwasmtime: Wasmtime doesn't fully sandbox all the Windows device filenames CVE-2024-47813Lowwasmtime: Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations CVE-2024-47763Mediumwasmtime: wasmtime has a runtime crash when combining tail calls with trapping imports CVE-2024-30266Lowwasmtime: Wasmtime vulnerable to panic when using a dropped extenref-typed element segment CVE-2022-39394Lowwasmtime: wasmtime_trap_code C API function has out of bounds write vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo