Is CVE-2026-34943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34943 being exploited in the wild.

How severe is CVE-2026-34943?

High severity, with a CVSS score of 7.5, published 9 April 2026.

Which products and versions are affected?

wasmtime (crates.io) SEMVER:introduced=0,fixed=24.0.7, SEMVER:introduced=0.0.0-0,fixed=24.0.7,introduced=25.0.0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1.

Is there a fix for CVE-2026-34943?

Yes. wasmtime (crates.io): upgrade to 24.0.7, 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-34943?

Check whether you run Bytecodealliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34943: Wasmtime has a possible panic when lifting `flags` component value

CVE-2026-34943 · Severity: high · CVSS 7.5 · Published 2026-04-09

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Technologies: Bytecodealliance Wasmtime, wasmtime (crates.io). Vendors: Bytecodealliance, crates.io.

Quick answers

Is CVE-2026-34943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34943 being exploited in the wild.
How severe is CVE-2026-34943?: High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?: wasmtime (crates.io) SEMVER:introduced=0,fixed=24.0.7, SEMVER:introduced=0.0.0-0,fixed=24.0.7,introduced=25.0.0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1.
Is there a fix for CVE-2026-34943?: Yes. wasmtime (crates.io): upgrade to 24.0.7, 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-34943?: Check whether you run Bytecodealliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime (crates.io): upgrade to 24.0.7, 43.0.1 or later
```
cargo update -p wasmtime
```

Affected products

Bytecodealliance Wasmtime
wasmtime (crates.io) SEMVER:introduced=0,fixed=24.0.7, SEMVER:introduced=0.0.0-0,fixed=24.0.7,introduced=25.0.0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1

Identifiers

CVE-2026-34943
GHSA-m758-wjhj-p3jq
RUSTSEC-2026-0085

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.