Your message dated Fri, 30 Oct 2026 14:34:43 +0000
with message-id <[email protected]>
and subject line Bug#1151856: fixed in rust-wasmtime 36.0.20+dfsg-1
has caused the Debian Bug report #1151856,
regarding rust-wasmtime: CVE-2026-115380 CVE-2026-115381 CVE-2026-115386
CVE-2026-115387 CVE-2026-115389 CVE-2026-115392
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151856: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151856
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rust-wasmtime
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for rust-wasmtime.
CVE-2026-115380[0]:
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before
| 49.0.2 contains a denial of service vulnerability in the wasmtime-
| wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host
| work per subscription without consuming or checking fuel. Malicious
| guest modules can pass many subscriptions to force long-running host
| computation that ignores configured fuel limits.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm
CVE-2026-115381[1]:
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before
| 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi
| WASIp2 write-zeroes method of SinkOutputStream, the default stream
| used when stdout/stderr are not configured. A malicious WebAssembly
| guest can request huge zero-filled writes, exhausting host memory
| and causing denial of service.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
CVE-2026-115386[2]:
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before
| 49.0.2 contains an information disclosure vulnerability in the
| WASIp1 fd_readdir implementation that copies uninitialized struct
| padding into guest memory. Guests with a preopened directory can
| list entries to receive three bytes of leftover host stack or heap
| memory per directory entry.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24
CVE-2026-115387[3]:
| Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before
| 49.0.1 contains a denial of service vulnerability in wasmtime-wasi
| that allows guest WASI programs to panic the host via overflowing
| filesystem timestamps. Attackers can pass atim or mtim values whose
| sub-second field overflows the seconds field to
| path_filestat_set_times, fd_filestat_set_times, set-times, or set-
| times-at, crashing the host.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h
CVE-2026-115389[4]:
| Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before
| 49.0.1 does not adequately account for host allocations when lifting
| guest values through the dynamically-typed Val API, bypassing the
| hostcall fuel limit. A malicious WebAssembly guest can return
| crafted values that allocate at least ~100x more host memory than
| tracked, causing denial of service.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr
https://rustsec.org/advisories/RUSTSEC-2026-0316.html
https://github.com/bytecodealliance/wasmtime/pull/14415
CVE-2026-115392[5]:
| Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before
| 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape
| in wasmtime-wasi because its cap-std dependency mishandles symlinks
| with trailing slashes on macOS and Linux kernels lacking openat2. A
| guest with write access to any sandboxed directory can read and
| write any host-accessible file, and read-only guests may read host
| files via preexisting symlinks.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg
https://rustsec.org/advisories/RUSTSEC-2026-0269.html
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-115380
https://www.cve.org/CVERecord?id=CVE-2026-115380
[1] https://security-tracker.debian.org/tracker/CVE-2026-115381
https://www.cve.org/CVERecord?id=CVE-2026-115381
[2] https://security-tracker.debian.org/tracker/CVE-2026-115386
https://www.cve.org/CVERecord?id=CVE-2026-115386
[3] https://security-tracker.debian.org/tracker/CVE-2026-115387
https://www.cve.org/CVERecord?id=CVE-2026-115387
[4] https://security-tracker.debian.org/tracker/CVE-2026-115389
https://www.cve.org/CVERecord?id=CVE-2026-115389
[5] https://security-tracker.debian.org/tracker/CVE-2026-115392
https://www.cve.org/CVERecord?id=CVE-2026-115392
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: rust-wasmtime
Source-Version: 36.0.20+dfsg-1
Done: Jonas Smedegaard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
rust-wasmtime, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jonas Smedegaard <[email protected]> (supplier of updated rust-wasmtime package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 30 Oct 2026 14:10:55 +0100
Source: rust-wasmtime
Architecture: source
Version: 36.0.20+dfsg-1
Distribution: unstable
Urgency: high
Maintainer: Jonas Smedegaard <[email protected]>
Changed-By: Jonas Smedegaard <[email protected]>
Closes: 1151856 1151861
Changes:
rust-wasmtime (36.0.20+dfsg-1) unstable; urgency=high
.
[ upstream ]
* new release(s);
RUSTSEC-2026-0020 / GHSA-852m-cvvp-9p4w / CVE-2026-27204,
RUSTSEC-2026-0269 / GHSA-vqjp-4c8c-hfgg / CVE-2026-115392,
RUSTSEC-2026-0313 / GHSA-c9gc-w9vx-w86p / CVE-2026-115388,
RUSTSEC-2026-0314 / GHSA-j2g9-4prp-pf6h / CVE-2026-115387,
RUSTSEC-2026-0316 / GHSA-jqpg-j7w6-42pr / CVE-2026-115389,
RUSTSEC-2026-0321 / GHSA-j366-h8gg-77pm / CVE-2026-115380,
RUSTSEC-2026-0322 / GHSA-gqmc-89g8-p25r / CVE-2026-115381,
RUSTSEC-2026-0323 / GHSA-96f6-r43r-8c24 / CVE-2026-115386,
RUSTSEC-2026-0363 / GHSA-q554-3cjc-rx7p,
RUSTSEC-2026-0376 / GHSA-r8xh-cgf7-392j,
RUSTSEC-2026-0379 / GHSA-mghf-wjfp-p5xm / CVE-2026-115893,
RUSTSEC-2026-0380 / GHSA-897f-g5gm-fmxm / CVE-2026-115889,
RUSTSEC-2026-0421 / GHSA-h4wp-g4x3-7398,
RUSTSEC-2026-0424 / GHSA-6fr9-xmw9-5352;
closes: bug#1151856, #1151861, thanks to Moritz Muehlenhoff
.
[ Jonas Smedegaard ]
* update watch file:
+ capitalize file format field label;
+ limit to STABLE_VERSION
* bump project versions in virtual packages and autopkgtests
* unfuzz patches
* set urgency=high due to security bugfixes
* add patch 1002_newer_codespan-reporting;
bump (build-)dependency for crate codespan-reporting
Checksums-Sha1:
eee47cc2b514cfcf529d3f2e3e2637cf7a6bccf3 4513 rust-wasmtime_36.0.20+dfsg-1.dsc
b40c595fcc5256aa808c26cc4d41db0c449031bf 4882568
rust-wasmtime_36.0.20+dfsg.orig.tar.xz
931a98c443271f75f5fe69ec1ff3c2b8ae6e4ed8 26556
rust-wasmtime_36.0.20+dfsg-1.debian.tar.xz
8c2e379b2b40be82a87f7fe22c9316281306b0d6 25711
rust-wasmtime_36.0.20+dfsg-1_amd64.buildinfo
Checksums-Sha256:
bdec7b05f2bd1f51ebb2915ed731667a29f39ceb8986ade8c05d0ee450054a03 4513
rust-wasmtime_36.0.20+dfsg-1.dsc
f09c01cbbcb719ac20e9558cec258d4575b8411ddecd0bf28fd817bceadfbf73 4882568
rust-wasmtime_36.0.20+dfsg.orig.tar.xz
d936bef2e2affb7d7c73a0cae02fee176ae4708b6b95411f445978a60022d76f 26556
rust-wasmtime_36.0.20+dfsg-1.debian.tar.xz
1592af7ad41659ffb946c818067700eca1827e8c24c64266b2fb8ade601551dc 25711
rust-wasmtime_36.0.20+dfsg-1_amd64.buildinfo
Files:
b53a1cc61430a629b1c5d6dd8e3b1c5a 4513 rust optional
rust-wasmtime_36.0.20+dfsg-1.dsc
e14e0ecedbba0956b19d614f0e8782ce 4882568 rust optional
rust-wasmtime_36.0.20+dfsg.orig.tar.xz
d83228317da499674d2d62e21258d94b 26556 rust optional
rust-wasmtime_36.0.20+dfsg-1.debian.tar.xz
cdcaed25cb52ee0e83e0bab1e595da7a 25711 rust optional
rust-wasmtime_36.0.20+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJABAEBCgAqFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAmrkoIEMHGRyQGpvbmVz
LmRrAAoJECx8MUbBoAEhX5kQAK5WMF+9TKhhGXa31W96cXwmGOUZwRwh/Xgnm9f8
7OJj/3gO5Erlr5+oUIFFA+N+9nF5Jmvyhyl1F0xV4Lor4N7l007Zds+gQVR9xtH0
wxPCsmvZ7Fo5yhCIl/5TKeuRovU9ToAHA0xCYrKB97zU/I3DbyYtYzI02h+QZABX
9tRgxhFWN0rMa6BN0fkGYQgAQwb0gZE8vtGnVBgqvVWY1IojUV9Rk2rHLs4lJmDr
zvFMw5+hh0JhfqqmmexwnX2niJ+sfgwE9VABBlgecKw6KPQvQH68fLBYoobxCbDe
097TfL6wkj6pFdRhi5eBxOClt7k0Fxl/bqgyLxDyHrrCuXZj5Nt0t6TnU0VfomMO
szTvCS3FPy3+n54nCspNb+M20LCFmlej6571F1c7tZJ0FcDB0sP/nMc1Tfx3lwE8
FAW6N5kPFlEOwZ9GugIPVf2tEr2I1nkuJDE6qYW9RoEQTbKNs/Qjzdx7dkit2vKk
uEFLcEWfI3aJpQEl3s21OlkGt39Yake4RDm4k/S0OOy3J5eLNj2o4WiWqcFYtO81
vlBosox9gcLwfHx5RDQi3jvXzOzJCBjAlIrSrmJtxgGXxpGC2Hx955rb5M2y65zm
1TIvIAg7kUxdz6zPHxUJ5pLHtdmkSTlVOGf+MbgxApxTCx4I5cZR7wCMy0/ALNIe
j8z6
=W4Bv
-----END PGP SIGNATURE-----
pgp0ZaCcC8r_j.pgp
Description: PGP signature
--- End Message ---
