# RUSTSEC-2026-0420 - wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving

Source: https://junglewise.ai/threats/rustsec-2026-0420-wasip3-udp-send-can-deliver-a-datagram-to-an-address-cfc65c09  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-10-29

wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving

Technologies: [wasmtime-wasi (crates.io)](https://junglewise.ai/threats/technologies/wasmtime-wasi). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 29 October 2026.

**Which products and versions are affected?** wasmtime-wasi (crates.io) SEMVER:introduced=48.0.0,fixed=48.0.8,introduced=49.0.0,fixed=49.0.5,introduced=50.0.0,fixed=50.0.1.

**Is there a fix for This vulnerability?** Yes. wasmtime-wasi (crates.io): upgrade to 50.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run wasmtime-wasi (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wasmtime-wasi (crates.io): upgrade to 50.0.1 or later

  ```sh
  cargo update -p wasmtime-wasi
  ```


## Affected products

- wasmtime-wasi (crates.io) SEMVER:introduced=48.0.0,fixed=48.0.8,introduced=49.0.0,fixed=49.0.5,introduced=50.0.0,fixed=50.0.1

## Identifiers

- GHSA-hmmr-87qq-258j
- RUSTSEC-2026-0420

## Related threats

- [Wasmtime-WASI filesystem sandbox escape with symlink rename](https://junglewise.ai/threats/rustsec-2026-0352-filesystem-sandbox-escape-when-renaming-symlinks-with-86b22c86)
- [RUSTSEC-2026-0321 - WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption](https://junglewise.ai/threats/rustsec-2026-0321-wasi-preview-0-implementation-of-poll-oneoff-67c5f6e0)
- [RUSTSEC-2026-0324 - Guest can panic host through filesystem timestamp before the epoch on wasip3](https://junglewise.ai/threats/rustsec-2026-0324-guest-can-panic-host-through-filesystem-timestamp-681be084)
- [wasmtime-wasi excessive memory allocation when guests lack stdio](https://junglewise.ai/threats/rustsec-2026-0322-excessive-allocated-memory-on-the-host-when-guests-84ef0787)
- [Wasmtime wasmtime-wasi fd_readdir information disclosure](https://junglewise.ai/threats/rustsec-2026-0323-fd-readdir-copies-uninitialized-struct-padding-into-ed3c3a69)