- Latest release
- 50.0.1 (Oct 29, 2026): no advisory affects it
- Newest unaffected release
- 50.0.1 (Oct 29, 2026), the latest release
- Advisories
- 66 · 6 critical, 3 high, 35 medium, 16 low
- Weekly downloads
- 946.6K
- Dependents
- 0
- Releases
- 239 since 0.0.0 (Oct 30, 2018)
- Registry
- crates.io
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-119143Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119142Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119140Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119139Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119138Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119137Affects 42.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119136Affects 42.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119135Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-119132Affects 49.0.0 to 49.0.2 (49.0.3 is outside it)
- RUSTSEC-2026-0424Affects 0.0.0 to 36.0.19 (36.0.20 is outside it); 37.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it)
- RUSTSEC-2026-0423Affects 47.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it)
- RUSTSEC-2026-0422Affects 47.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it)
Show all 66 advisoriesShow fewer advisories
- CVE-2026-115893Affects 0.0.0 to 36.0.18 (36.0.19 is outside it); 37.0.0 to 48.0.6 (48.0.7 is outside it); 49.0.0 to 49.0.3 (49.0.4 is outside it)
- CVE-2026-115892Affects 46.0.0 to 48.0.6 (48.0.7 is outside it); 49.0.0 to 49.0.3 (49.0.4 is outside it)
- CVE-2026-115889Affects 0.0.0 to 36.0.18 (36.0.19 is outside it); 37.0.0 to 42.0.2 (43.0.0 is outside it)
- CVE-2026-115393Affects 0.0.0 to 24.0.11 (24.0.12 is outside it); 25.0.0 to 36.0.12 (36.0.13 is outside it); 37.0.0 to 46.0.1 (46.0.2 is outside it); 47.0.0 to 47.0.2 (47.0.3 is outside it)
- CVE-2026-115392Affects 0.0.0 to 24.0.12 (24.0.13 is outside it); 25.0.0 to 36.0.13 (36.0.14 is outside it); 37.0.0 to 46.0.2 (46.0.3 is outside it); 47.0.0 to 47.0.3 (47.0.4 is outside it)
- CVE-2026-115391Affects 46.0.0 to 46.0.2 (46.0.3 is outside it); 47.0.0 to 47.0.3 (47.0.4 is outside it)
- CVE-2026-115390Affects 47.0.0 to 48.0.2 (48.0.3 is outside it); 49.0.0 (49.0.1 is outside it)
- CVE-2026-115389Affects 0.0.0 to 36.0.15 (36.0.16 is outside it); 37.0.0 to 48.0.2 (48.0.3 is outside it); 49.0.0 (49.0.1 is outside it)
- CVE-2026-115384Affects 39.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
- CVE-2026-115383Affects 47.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
- CVE-2026-115379Affects 47.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
- RUSTSEC-2026-0364Affects 47.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- RUSTSEC-2026-0363Affects 0.0.0 to 36.0.17 (36.0.18 is outside it); 37.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- RUSTSEC-2026-0356Affects 46.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
- CVE-2026-104855Affects 46.0.0 to 46.0.1 (46.0.2 is outside it); 47.0.0 to 47.0.2 (47.0.3 is outside it)
- CVE-2026-44216Affects 30.0.0 to 36.0.7 (36.0.8 is outside it); 37.0.0 to 43.0.1 (43.0.2 is outside it); 44.0.0 (44.0.1 is outside it)
- CVE-2026-35195Affects 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-35186Affects 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34988Affects 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34987Affects 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34983Affects 43.0.0 (43.0.1 is outside it)
- CVE-2026-34971Affects 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34946Affects 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34945Affects 0.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34944Affects 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34943Affects 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34942Affects 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-34941Affects 0.0.0 to 24.0.6 (24.0.7 is outside it); 25.0.0 to 36.0.6 (36.0.7 is outside it); 37.0.0 to 42.0.1 (42.0.2 is outside it); 43.0.0 (43.0.1 is outside it)
- CVE-2026-27572Affects 0.0.0 to 24.0.5 (24.0.6 is outside it); 25.0.0 to 36.0.5 (36.0.6 is outside it); 37.0.0 to 40.0.3 (40.0.4 is outside it); 41.0.0 to 41.0.3 (41.0.4 is outside it)
- CVE-2026-27204Affects 0.0.0 to 24.0.5 (24.0.6 is outside it); 25.0.0 to 36.0.5 (36.0.6 is outside it); 37.0.0 to 40.0.3 (40.0.4 is outside it); 41.0.0 to 41.0.3 (41.0.4 is outside it)
- CVE-2026-27195Affects 39.0.0 to 40.0.3 (40.0.4 is outside it); 41.0.0 to 41.0.3 (41.0.4 is outside it)
- CVE-2026-24116Affects 29.0.0 to 36.0.4 (36.0.5 is outside it); 37.0.0 to 40.0.2 (40.0.3 is outside it); 41.0.0 (41.0.1 is outside it)
- CVE-2025-64345Affects 0.0.0 to 24.0.4 (24.0.5 is outside it); 25.0.0 to 36.0.2 (36.0.3 is outside it); 37.0.0 to 37.0.2 (37.0.3 is outside it); 38.0.0 to 38.0.3 (38.0.4 is outside it)
- CVE-2025-62711Affects 38.0.0 to 38.0.2 (38.0.3 is outside it)
- CVE-2025-53901Affects 10.0.0 to 24.0.3 (24.0.4 is outside it); 25.0.0 to 33.0.1 (33.0.2 is outside it); 34.0.0 to 34.0.1 (34.0.2 is outside it)
- CVE-2024-51745Affects 0.0.0 to 24.0.1 (24.0.2 is outside it); 25.0.0 to 25.0.2 (25.0.3 is outside it); 26.0.0 (26.0.1 is outside it)
- CVE-2024-47813Affects 19.0.0 to 21.0.1 (21.0.2 is outside it); 22.0.0 (22.0.1 is outside it); 23.0.0 to 23.0.2 (23.0.3 is outside it); 24.0.0 (24.0.1 is outside it); 25.0.0 to 25.0.1 (25.0.2 is outside it)
- CVE-2024-47763Affects 12.0.0 to 21.0.1 (21.0.2 is outside it); 22.0.0 (22.0.1 is outside it); 23.0.0 to 23.0.2 (23.0.3 is outside it); 24.0.0 (24.0.1 is outside it); 25.0.0 to 25.0.1 (25.0.2 is outside it)
- CVE-2024-30266Affects 19.0.0 (19.0.1 is outside it)
- CVE-2023-41880Affects 0.0.0 to 10.0.1 (10.0.2 is outside it); 11.0.0 to 11.0.1 (11.0.2 is outside it); 12.0.0 to 12.0.1 (12.0.2 is outside it)
- CVE-2023-30624Affects 0.0.0 to 6.0.1 (6.0.2 is outside it); 7.0.0 (7.0.1 is outside it); 8.0.0 (8.0.1 is outside it)
- CVE-2023-26489Affects 0.0.0 to 4.0.0 (4.0.1 is outside it); 5.0.0 (5.0.1 is outside it); 6.0.0 (6.0.1 is outside it)
- CVE-2023-27477Affects 0.0.0 to 4.0.0 (4.0.1 is outside it); 5.0.0 (5.0.1 is outside it); 6.0.0 (6.0.1 is outside it)
- CVE-2022-39394Affects 0.0.0 to 1.0.1 (1.0.2 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it)
- CVE-2022-39393Affects 0.0.0 to 1.0.1 (1.0.2 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it)
- CVE-2022-39392Affects 0.0.0 to 1.0.1 (1.0.2 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it)
- CVE-2022-31169Affects 0.0.0 to 0.38.1 (0.38.2 is outside it)
- CVE-2022-31146Affects 0.0.0 to 0.38.1 (0.38.2 is outside it)
- CVE-2022-31104Affects 0.0.0 to 0.38.0 (0.38.1 is outside it)
- CVE-2022-24791Affects 0.0.0 to 0.34.1 (0.34.2 is outside it); 0.35.0 to 0.35.1 (0.35.2 is outside it)
- CVE-2022-23636Affects 0.0.0 to 0.38.1 (0.38.2 is outside it)
- CVE-2021-39218Affects 0.0.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2021-39219Affects 0.0.0 to 0.29.0 (0.30.0 is outside it)
- CVE-2021-39216Affects 0.0.0 to 0.29.0 (0.30.0 is outside it)
Advisories 66
- CVE-2026-119143Medium 5.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119142Medium 5.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119140Medium 5.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119139Medium 5.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119138Medium 5.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119137Medium 6.9
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
Affected: from 42.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119136Medium 5.9
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
Affected: from 42.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119135Medium 5.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, 15 days before disclosure) and 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-119132Medium 5.9
Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
Affected: from 49.0.0, fixed in 49.0.3.
Fixed in 49.0.3 (released Oct 14, 2026, 15 days before disclosure).
The latest release, 50.0.1, is not affected.
- RUSTSEC-2026-0424Unrated
Unchecked memory usage in transferring borrowed resources between components
Affected: fixed in 36.0.20; from 37.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1.
Fixed in 36.0.20 (released Oct 29, 2026, the day of disclosure), 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- RUSTSEC-2026-0423Unrated
Cross-engine type confusion with host-created struct-types-with-supertypes
Affected: from 47.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1.
Fixed in 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 50.0.1 (released Oct 29, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- RUSTSEC-2026-0422Unrated
Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check
Affected: from 47.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1.
Fixed in 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 50.0.1 (released Oct 29, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115893Critical 9.9
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Affected: fixed in 36.0.19; from 37.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4; fixed in 36.0.19; from 37.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4.
Fixed in 36.0.19 (released Oct 19, 2026, 4 days before disclosure), 48.0.7 (released Oct 19, 2026, 4 days before disclosure) and 49.0.4 (released Oct 19, 2026, 4 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115892Medium 5.7
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Affected: from 46.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4; from 46.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4.
Fixed in 48.0.7 (released Oct 19, 2026, 4 days before disclosure) and 49.0.4 (released Oct 19, 2026, 4 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115889Critical 9.9
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Affected: fixed in 36.0.19; from 37.0.0, fixed in 43.0.0; fixed in 36.0.19; from 37.0.0, fixed in 43.0.0.
Fixed in 36.0.19 (released Oct 19, 2026, 4 days before disclosure) and 43.0.0 (released Mar 20, 2026, 217 days before disclosure).
The latest release, 50.0.1, is not affected.
Show all 66 advisoriesShow fewer advisories
- CVE-2026-115393Low 1.0
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion
Affected: fixed in 24.0.12; from 25.0.0, fixed in 36.0.13; from 37.0.0, fixed in 46.0.2; from 47.0.0, fixed in 47.0.3.
Fixed in 24.0.12 (released Jul 31, 2026, 83 days before disclosure), 36.0.13 (released Jul 31, 2026, 83 days before disclosure), 46.0.2 (released Jul 31, 2026, 83 days before disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-115392High 8.8
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes
Affected: fixed in 24.0.13; from 25.0.0, fixed in 36.0.14; from 37.0.0, fixed in 46.0.3; from 47.0.0, fixed in 47.0.4.
Fixed in 24.0.13 (released Aug 20, 2026, 63 days before disclosure), 36.0.14 (released Aug 20, 2026, 63 days before disclosure), 46.0.3 (released Aug 20, 2026, 63 days before disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-115391Medium 6.9
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
Affected: from 46.0.0, fixed in 46.0.3; from 47.0.0, fixed in 47.0.4.
Fixed in 46.0.3 (released Aug 20, 2026, 63 days before disclosure) and 47.0.4 (released Aug 20, 2026, 63 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115390Medium 6.9
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS
Affected: from 47.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1.
Fixed in 48.0.3 (released Sep 24, 2026, 28 days before disclosure) and 49.0.1 (released Sep 24, 2026, 28 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115389Low 1.0
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API
Affected: fixed in 36.0.16; from 37.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1.
Fixed in 36.0.16 (released Sep 24, 2026, 28 days before disclosure), 48.0.3 (released Sep 24, 2026, 28 days before disclosure) and 49.0.1 (released Sep 24, 2026, 28 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115384Critical 9.4
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
Affected: from 39.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115383Medium 5.9
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
Affected: from 47.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-115379Medium 6.9
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
Affected: from 47.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
- RUSTSEC-2026-0364Unrated
Exception tags can cause host data structures to be unaligned
Affected: from 47.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, the day of disclosure) and 49.0.3 (released Oct 14, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- RUSTSEC-2026-0363Unrated
Component-model handle tables are capped only per instance and charged to no limit
Affected: fixed in 36.0.18; from 37.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 36.0.18 (released Oct 14, 2026, the day of disclosure), 48.0.6 (released Oct 14, 2026, the day of disclosure) and 49.0.3 (released Oct 14, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- RUSTSEC-2026-0356Unrated
Panic on erroneous call-to-host from guest realloc call
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 48.0.6 (released Oct 14, 2026, the day of disclosure) and 49.0.3 (released Oct 14, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-104855Low 2.0
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Affected: from 46.0.0, fixed in 46.0.2; from 47.0.0, fixed in 47.0.3; from 46.0.0, fixed in 46.0.2; from 47.0.0, fixed in 47.0.3.
Fixed in 46.0.2 (released Jul 31, 2026, 63 days before disclosure) and 47.0.3 (released Jul 31, 2026, 63 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-44216Medium 5.9
Wasmtime: Panic when allocating a table exceeding the size of the host's address space
Affected: from 30.0.0, fixed in 36.0.8; from 37.0.0, fixed in 43.0.2; from 44.0.0, fixed in 44.0.1; from 30.0.0, fixed in 36.0.8; from 37.0.0, fixed in 43.0.2.
Fixed in 36.0.8 (released Apr 30, 2026, 14 days before disclosure), 43.0.2 (released Apr 30, 2026, 14 days before disclosure) and 44.0.1 (released Apr 30, 2026, 14 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-35195Medium 6.1
Wasmtime has an out-of-bounds write or crash when transcoding component model strings
Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-35186Medium 6.1
Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend
Affected: from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34988Low 2.3
Wasmtime leaks data between pooling allocator instances
Affected: fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; from 28.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34987Critical 9.0
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
Affected: from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34983Low 1.0
Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`
Affected: from 43.0.0, fixed in 43.0.1; from 43.0.0, fixed in 43.0.1.
Fixed in 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34971Critical 9.0
Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
Affected: from 32.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34946Medium 5.9
Wasmtime's host panics when Winch compiler executes `table.fill`
Affected: fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34945Low 2.3
Wasmtime leaks host data with 64-bit tables and Winch
Affected: from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 43.0.1 (released Apr 9, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-34944Medium 4.1
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-34943Medium 5.6
Wasmtime panics when lifting `flags` component value
Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-34942Medium 5.9
Wasmtime panics when transcoding misaligned utf-16 strings
Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-34941Medium 6.9
Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Affected: fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1; fixed in 24.0.7; from 25.0.0, fixed in 36.0.7; from 37.0.0, fixed in 42.0.2; from 43.0.0, fixed in 43.0.1.
Fixed in 24.0.7 (released Apr 9, 2026, the day of disclosure), 36.0.7 (released Apr 9, 2026, the day of disclosure), 42.0.2 (released Apr 9, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-27572Medium 6.9
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Affected: fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4; fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4.
Fixed in 24.0.6 (released Feb 24, 2026, the day of disclosure), 36.0.6 (released Feb 24, 2026, the day of disclosure), 40.0.4 (released Feb 24, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-27204Medium 6.9
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
Affected: fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4; fixed in 24.0.6; from 25.0.0, fixed in 36.0.6; from 37.0.0, fixed in 40.0.4.
Fixed in 24.0.6 (released Feb 24, 2026, the day of disclosure), 36.0.6 (released Feb 24, 2026, the day of disclosure), 40.0.4 (released Feb 24, 2026, the day of disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2026-27195Medium 6.9
Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
Affected: from 39.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4; from 39.0.0, fixed in 40.0.4; from 41.0.0, fixed in 41.0.4.
Fixed in 40.0.4 (released Feb 24, 2026, the day of disclosure) and 41.0.4 (released Feb 24, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2026-24116Medium 4.1
Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64
Affected: from 29.0.0, fixed in 36.0.5; from 37.0.0, fixed in 40.0.3; from 41.0.0, fixed in 41.0.1; from 29.0.0, fixed in 36.0.5; from 37.0.0, fixed in 40.0.3; from 41.0.0, fixed in 41.0.1.
Fixed in 36.0.5 (released Jan 26, 2026, 1 day before disclosure), 40.0.3 (released Jan 27, 2026, the day of disclosure) and 41.0.1 (released Jan 27, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2025-64345Low 1.8
Wasmtime provides unsound API access to a WebAssembly shared linear memory
Affected: from 38.0.0, fixed in 38.0.4; from 37.0.0, fixed in 37.0.3; from 26.0.0, fixed in 36.0.3; fixed in 24.0.5; fixed in 24.0.5; from 25.0.0, fixed in 36.0.3; from 37.0.0, fixed in 37.0.3; from 38.0.0, fixed in 38.0.4.
Fixed in 24.0.5 (released Nov 11, 2025, 1 day before disclosure), 36.0.3 (released Nov 11, 2025, 1 day before disclosure), 37.0.3 (released Nov 11, 2025, 1 day before disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
- CVE-2025-62711Low 2.1
Wasmtime vulnerable to segfault when using component resources
Affected: from 38.0.0, fixed in 38.0.3.
Fixed in 38.0.3 (released Oct 24, 2025, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2025-53901Low 3.5
Wasmtime has host panic with `fd_renumber` WASIp1 function
Affected: from 10.0.0, fixed in 24.0.4; from 33.0.0, fixed in 33.0.2; from 34.0.0, fixed in 34.0.2; from 10.0.0, fixed in 24.0.4; from 25.0.0, fixed in 33.0.2; from 34.0.0, fixed in 34.0.2.
Fixed in 24.0.4 (released Jul 18, 2025, the day of disclosure), 33.0.2 (released Jul 18, 2025, the day of disclosure) and 34.0.2 (released Jul 18, 2025, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2024-51745Low 2.3
Wasmtime doesn't fully sandbox all the Windows device filenames
Affected: fixed in 24.0.2; from 25.0.0, fixed in 25.0.3; from 26.0.0, fixed in 26.0.1; fixed in 24.0.2; from 25.0.0, fixed in 25.0.3; from 26.0.0, fixed in 26.0.1.
Fixed in 24.0.2 (released Nov 5, 2024, the day of disclosure), 25.0.3 (released Nov 5, 2024, the day of disclosure) and 26.0.1 (released Nov 5, 2024, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2024-47813Low 2.9
Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations
Affected: from 19.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2; from 19.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2.
Fixed in 21.0.2 (released Oct 9, 2024, the day of disclosure), 22.0.1 (released Oct 9, 2024, the day of disclosure), 23.0.3 (released Oct 9, 2024, the day of disclosure) and 2 other versions.
The latest release, 50.0.1, is not affected.
- CVE-2024-47763Medium 5.5
Wasmtime runtime crash when combining tail calls with trapping imports
Affected: from 12.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2; from 21.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.1; from 23.0.0, fixed in 23.0.3; from 24.0.0, fixed in 24.0.1; from 25.0.0, fixed in 25.0.2.
Fixed in 21.0.2 (released Oct 9, 2024, the day of disclosure), 22.0.1 (released Oct 9, 2024, the day of disclosure), 23.0.3 (released Oct 9, 2024, the day of disclosure) and 2 other versions.
The latest release, 50.0.1, is not affected.
- CVE-2024-30266Low 3.3
Wasmtime vulnerable to panic when using a dropped extenref-typed element segment
Affected: from 19.0.0, fixed in 19.0.1; from 19.0.0, fixed in 19.0.1.
Fixed in 19.0.1 (released Apr 2, 2024, 2 days before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2023-41880Low 2.2
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64
Affected: fixed in 10.0.2; from 11.0.0, fixed in 11.0.2; from 12.0.0, fixed in 12.0.2; from 10.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.2; from 12.0.0, fixed in 12.0.2.
Fixed in 10.0.2 (released Sep 14, 2023, 1 day before disclosure), 11.0.2 (released Sep 14, 2023, 1 day before disclosure) and 12.0.2 (released Sep 14, 2023, 1 day before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2023-30624Low 3.9
Wasmtime has Undefined Behavior in Rust runtime functions
Affected: fixed in 6.0.2; from 7.0.0, fixed in 7.0.1; from 8.0.0, fixed in 8.0.1; fixed in 6.0.2; from 7.0.0, fixed in 7.0.1; from 8.0.0, fixed in 8.0.1.
Fixed in 6.0.2 (released Apr 27, 2023, the day of disclosure), 7.0.1 (released Apr 27, 2023, the day of disclosure) and 8.0.1 (released Apr 27, 2023, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2023-26489Critical 10.0
Guest-controlled out-of-bounds read/write on x86_64 in wasmtime
Affected: fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1; from 0.37.0, fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1.
Fixed in 4.0.1 (released Mar 8, 2023, the day of disclosure), 5.0.1 (released Mar 8, 2023, the day of disclosure) and 6.0.1 (released Mar 8, 2023, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2023-27477Low 3.1
wasmtime is a fast and secure runtime for WebAssembly.
Affected: fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1; from 1.0.0, fixed in 4.0.1; from 5.0.0, fixed in 5.0.1; from 6.0.0, fixed in 6.0.1.
Fixed in 4.0.1 (released Mar 8, 2023, the day of disclosure), 5.0.1 (released Mar 8, 2023, the day of disclosure) and 6.0.1 (released Mar 8, 2023, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-39394Low 3.8
wasmtime_trap_code C API function has out of bounds write vulnerability
Affected: fixed in 1.0.2; from 2.0.0, fixed in 2.0.2; from 2.0.0, fixed in 2.0.2; fixed in 1.0.2.
Fixed in 1.0.2 (released Nov 11, 2022, 1 day after disclosure) and 2.0.2 (released Nov 10, 2022, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-39393High 8.6
Wasmtime vulnerable to data leakage between instances in the pooling allocator
Affected: fixed in 1.0.2; from 2.0.0, fixed in 2.0.2; from 2.0.0, fixed in 2.0.2; fixed in 1.0.2.
Fixed in 1.0.2 (released Nov 11, 2022, 1 day after disclosure) and 2.0.2 (released Nov 10, 2022, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-39392Medium 5.9
Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration
Affected: fixed in 1.0.2; from 2.0.0, fixed in 2.0.2; from 2.0.0, fixed in 2.0.2; fixed in 1.0.2.
Fixed in 1.0.2 (released Nov 11, 2022, 1 day after disclosure) and 2.0.2 (released Nov 10, 2022, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-31169Medium 5.9
Cranelift vulnerable to miscompilation of constant values in division on AArch64
Affected: fixed in 0.33.1; from 0.34.0, fixed in 0.34.1; fixed in 0.38.2; from 0.34.0, fixed in 0.34.1; fixed in 0.33.1; fixed in 0.38.2.
Fixed in 0.38.2 (released Jul 20, 2022, 1 day before disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-31146Medium 6.4
Use After Free in Wasmtime
Affected: from 0.37.0, fixed in 0.38.2; fixed in 0.38.2.
Fixed in 0.38.2 (released Jul 20, 2022, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-31104Medium 4.8
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
Affected: fixed in 0.38.1; fixed in 0.38.1.
Fixed in 0.38.1 (released Jun 27, 2022, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-24791High 8.1
Use after free in Wasmtime
Affected: from 0.34.0, fixed in 0.34.2; from 0.35.0, fixed in 0.35.2; fixed in 0.34.2; from 0.35.0, fixed in 0.35.2; fixed in 0.34.2; from 0.35.0, fixed in 0.35.2.
Fixed in 0.34.2 (released Mar 31, 2022, the day of disclosure) and 0.35.2 (released Mar 31, 2022, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2022-23636Medium 5.1
Invalid drop of partially-initialized instances in wasmtime
Affected: fixed in 0.33.1; from 0.34.0, fixed in 0.34.1; fixed in 0.38.2; from 0.34.0, fixed in 0.34.1; fixed in 0.33.1; fixed in 0.38.2.
Fixed in 0.38.2 (released Jul 20, 2022, 154 days after disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2021-39218Medium 6.3
Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
Affected: fixed in 0.30.0; from 0.26.0, fixed in 0.30.0; fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 17, 2021, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2021-39219Medium 6.3
Wrong type for `Linker`-define functions when used across two `Engine`s
Affected: fixed in 0.30.0; from 0.26.0, fixed in 0.30.0; fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 17, 2021, the day of disclosure).
The latest release, 50.0.1, is not affected.
- CVE-2021-39216Medium 6.3
Use after free passing `externref`s to Wasm in Wasmtime
Affected: fixed in 0.30.0; from 0.26.0, fixed in 0.30.0; fixed in 0.30.0.
Fixed in 0.30.0 (released Sep 17, 2021, the day of disclosure).
The latest release, 50.0.1, is not affected.