Source: rust-wasmtime X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for rust-wasmtime. CVE-2026-115380[0]: | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before | 49.0.2 contains a denial of service vulnerability in the wasmtime- | wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host | work per subscription without consuming or checking fuel. Malicious | guest modules can pass many subscriptions to force long-running host | computation that ignores configured fuel limits. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm CVE-2026-115381[1]: | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before | 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi | WASIp2 write-zeroes method of SinkOutputStream, the default stream | used when stdout/stderr are not configured. A malicious WebAssembly | guest can request huge zero-filled writes, exhausting host memory | and causing denial of service. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv CVE-2026-115386[2]: | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before | 49.0.2 contains an information disclosure vulnerability in the | WASIp1 fd_readdir implementation that copies uninitialized struct | padding into guest memory. Guests with a preopened directory can | list entries to receive three bytes of leftover host stack or heap | memory per directory entry. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 CVE-2026-115387[3]: | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before | 49.0.1 contains a denial of service vulnerability in wasmtime-wasi | that allows guest WASI programs to panic the host via overflowing | filesystem timestamps. Attackers can pass atim or mtim values whose | sub-second field overflows the seconds field to | path_filestat_set_times, fd_filestat_set_times, set-times, or set- | times-at, crashing the host. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h CVE-2026-115389[4]: | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before | 49.0.1 does not adequately account for host allocations when lifting | guest values through the dynamically-typed Val API, bypassing the | hostcall fuel limit. A malicious WebAssembly guest can return | crafted values that allocate at least ~100x more host memory than | tracked, causing denial of service. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr https://rustsec.org/advisories/RUSTSEC-2026-0316.html https://github.com/bytecodealliance/wasmtime/pull/14415 CVE-2026-115392[5]: | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before | 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape | in wasmtime-wasi because its cap-std dependency mishandles symlinks | with trailing slashes on macOS and Linux kernels lacking openat2. A | guest with write access to any sandboxed directory can read and | write any host-accessible file, and read-only guests may read host | files via preexisting symlinks. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg https://rustsec.org/advisories/RUSTSEC-2026-0269.html If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115380 https://www.cve.org/CVERecord?id=CVE-2026-115380 [1] https://security-tracker.debian.org/tracker/CVE-2026-115381 https://www.cve.org/CVERecord?id=CVE-2026-115381 [2] https://security-tracker.debian.org/tracker/CVE-2026-115386 https://www.cve.org/CVERecord?id=CVE-2026-115386 [3] https://security-tracker.debian.org/tracker/CVE-2026-115387 https://www.cve.org/CVERecord?id=CVE-2026-115387 [4] https://security-tracker.debian.org/tracker/CVE-2026-115389 https://www.cve.org/CVERecord?id=CVE-2026-115389 [5] https://security-tracker.debian.org/tracker/CVE-2026-115392 https://www.cve.org/CVERecord?id=CVE-2026-115392 Please adjust the affected versions in the BTS as needed.
