crates.ioPackage

wasmtime-wasi

11 known vulnerabilities (2 high, 5 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release: 50.0.1 (Oct 29, 2026): no advisory affects it
Newest unaffected release: 50.0.1 (Oct 29, 2026), the latest release
Advisories: 11 · 2 high, 5 medium, 3 low

Weekly downloads: 335.6K
Dependents: 0
Releases: 240 since 0.2.0 (Aug 21, 2019)
Registry: crates.io
Releases read: Nov 8, 2026

Version timeline

RUSTSEC-2026-0420
Affects 48.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it)
CVE-2026-118688
Affects 0.2.0 to 36.0.17 (36.0.18 is outside it); 37.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it)
CVE-2026-115387
Affects 0.2.0 to 36.0.15 (36.0.16 is outside it); 37.0.0 to 48.0.2 (48.0.3 is outside it); 49.0.0 (49.0.1 is outside it)
CVE-2026-115386
Affects 0.2.0 to 36.0.16 (36.0.17 is outside it); 37.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
CVE-2026-115385
Affects 46.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
CVE-2026-115381
Affects 0.2.0 to 36.0.16 (36.0.17 is outside it); 37.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
CVE-2026-115380
Affects 0.2.0 to 36.0.16 (36.0.17 is outside it); 37.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it)
CVE-2026-58494
Affects 0.2.0 to 24.0.10 (24.0.11 is outside it); 25.0.0 to 36.0.11 (36.0.12 is outside it); 37.0.0 to 45.0.2 (45.0.3 is outside it); 46.0.0 (46.0.1 is outside it)
CVE-2026-54786
Affects 0.2.0 to 24.0.9 (24.0.10 is outside it); 25.0.0 to 36.0.10 (36.0.11 is outside it); 37.0.0 to 44.0.2 (44.0.3 is outside it); 45.0.0 to 45.0.1 (45.0.2 is outside it)
CVE-2026-47261
Affects 0.2.0 to 24.0.8 (24.0.9 is outside it); 25.0.0 to 36.0.9 (36.0.10 is outside it); 37.0.0 to 44.0.1 (44.0.2 is outside it)
CVE-2025-53901
Affects 0.2.0 to 24.0.3 (24.0.4 is outside it); 25.0.0 to 33.0.1 (33.0.2 is outside it); 34.0.0 to 34.0.1 (34.0.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

RUSTSEC-2026-0420Unrated
wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving
Affected: from 48.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1.
Fixed in 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 50.0.1 (released Oct 29, 2026, the day of disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-118688High 8.8
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename
Affected: fixed in 36.0.18; from 37.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
Fixed in 36.0.18 (released Oct 14, 2026, 14 days before disclosure), 48.0.6 (released Oct 14, 2026, 14 days before disclosure) and 49.0.3 (released Oct 14, 2026, 14 days before disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-115387Medium 6.9
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow
Affected: fixed in 36.0.16; from 37.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1.
Fixed in 36.0.16 (released Sep 24, 2026, 28 days before disclosure), 48.0.3 (released Sep 24, 2026, 28 days before disclosure) and 49.0.1 (released Sep 24, 2026, 28 days before disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-115386Low 2.1
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
Affected: fixed in 36.0.17; from 37.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 36.0.17 (released Oct 2, 2026, 20 days before disclosure), 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-115385Medium 6.9
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
Affected: from 46.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-115381Medium 5.9
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes
Affected: fixed in 36.0.17; from 37.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 36.0.17 (released Oct 2, 2026, 20 days before disclosure), 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-115380Medium 5.1
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff
Affected: fixed in 36.0.17; from 37.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.
Fixed in 36.0.17 (released Oct 2, 2026, 20 days before disclosure), 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure).
The latest release, 50.0.1, is not affected.
CVE-2026-58494Medium 6.5
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Affected: fixed in 24.0.11; from 25.0.0, fixed in 36.0.12; from 37.0.0, fixed in 45.0.3; from 46.0.0, fixed in 46.0.1; fixed in 24.0.11; from 25.0.0, fixed in 36.0.12; from 37.0.0, fixed in 45.0.3; from 46.0.0, fixed in 46.0.1.
Fixed in 24.0.11 (released Jun 24, 2026, 14 days before disclosure), 36.0.12 (released Jun 24, 2026, 14 days before disclosure), 45.0.3 (released Jun 24, 2026, 14 days before disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
CVE-2026-54786Low 2.3
Wasmtime: Leak in WASIp1 `fd_renumber` implementation
Affected: fixed in 24.0.10; from 45.0.0, fixed in 45.0.2; from 25.0.0, fixed in 36.0.11; from 37.0.0, fixed in 44.0.3; fixed in 24.0.10; from 25.0.0, fixed in 36.0.11; from 37.0.0, fixed in 44.0.3; from 45.0.0, fixed in 45.0.2.
Fixed in 24.0.10 (released Jun 15, 2026, 16 days before disclosure), 36.0.11 (released Jun 15, 2026, 16 days before disclosure), 44.0.3 (released Jun 15, 2026, 16 days before disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
CVE-2026-47261High 7.5
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Affected: fixed in 24.0.9; from 25.0.0, fixed in 36.0.10; from 37.0.0, fixed in 44.0.2; from 45.0.0, fixed in 45.0.0; from 37.0.0, fixed in 44.0.2; from 25.0.0, fixed in 36.0.10; fixed in 24.0.9.
Fixed in 24.0.9 (released May 21, 2026, 25 days before disclosure), 36.0.10 (released May 21, 2026, 25 days before disclosure), 44.0.2 (released May 21, 2026, 25 days before disclosure) and 1 other version.
The latest release, 50.0.1, is not affected.
CVE-2025-53901Low 3.5
Wasmtime has host panic with `fd_renumber` WASIp1 function
Affected: fixed in 24.0.4; from 25.0.0, fixed in 33.0.2; from 34.0.0, fixed in 34.0.2.
Fixed in 24.0.4 (released Jul 18, 2025, the day of disclosure), 33.0.2 (released Jul 18, 2025, the day of disclosure) and 34.0.2 (released Jul 18, 2025, the day of disclosure).
The latest release, 50.0.1, is not affected.