# wasmtime (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/wasmtime Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/wasmtime.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 67 vulnerabilities in wasmtime (crates.io): 0 in the last 7 days and 28 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, Wasmtime type confusion with host-created struct types, was published on 29 October 2026. 21 vulnerabilities in the last four weeks, up 320% on the four before (5). 2 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 21 - Last 90 days: 28 - All time: 67 (3 critical, 0 exploited in the wild) ## About wasmtime (crates.io) WebAssembly runtime environment for executing WebAssembly modules outside the browser. ## Latest wasmtime (crates.io) vulnerabilities - [Wasmtime type confusion with host-created struct types](https://junglewise.ai/threats/rustsec-2026-0423-cross-engine-type-confusion-with-host-created-struct-89fe3f0e) (info, published 29 Oct 2026) - [RUSTSEC-2026-0422 - Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check](https://junglewise.ai/threats/rustsec-2026-0422-typed-functions-with-i31-or-nullref-arguments-may-0545dc2b) (low, CVSS 3.1, published 29 Oct 2026) - [Wasmtime unchecked memory usage in borrowed resource transfer](https://junglewise.ai/threats/rustsec-2026-0424-unchecked-memory-usage-in-transferring-borrowed-b297503c) (info, published 29 Oct 2026) - [CVE-2026-115893: Wasmtime Cranelift aarch64 br_table sandbox escape](https://junglewise.ai/threats/cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-115892: Wasmtime component-model type-check bypass in stream/future lowering](https://junglewise.ai/threats/cve-2026-115892-wasmtime-is-a-runtime-for-webassembly-from-46-0-0-until-48-0-7) (medium, CVSS 4, published 23 Oct 2026) - [CVE-2026-115889: Wasmtime Cranelift SSA value index overflow](https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0) (critical, CVSS 9.9, published 23 Oct 2026) - [RUSTSEC-2026-0379 - Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction](https://junglewise.ai/threats/rustsec-2026-0379-cranelift-backend-on-aarch64-can-jump-to-incorrect-f8a31e7c) (low, CVSS 3.1, published 19 Oct 2026) - [RUSTSEC-2026-0380 - Bit-packing in Cranelift compiler causes silent overflow and miscompilation](https://junglewise.ai/threats/rustsec-2026-0380-bit-packing-in-cranelift-compiler-causes-silent-62942749) (low, CVSS 3.1, published 19 Oct 2026) - [Wasmtime panic lowering host-created component model stream](https://junglewise.ai/threats/rustsec-2026-0378-panic-lowering-a-host-created-component-model-stream-b1c248ac) (medium, CVSS 4, published 19 Oct 2026) - [Wasmtime exception tags data structure alignment issue](https://junglewise.ai/threats/rustsec-2026-0364-exception-tags-can-cause-host-data-structures-to-be-90c7567f) (medium, CVSS 4, published 14 Oct 2026) - [RUSTSEC-2026-0359 - Stack overflow dropping a long chain of recursive types](https://junglewise.ai/threats/rustsec-2026-0359-stack-overflow-dropping-a-long-chain-of-recursive-ffabaaf3) (low, CVSS 3.1, published 14 Oct 2026) - [Wasmtime host panic in call_async cancellation](https://junglewise.ai/threats/rustsec-2026-0354-host-panic-when-component-call-async-is-cancelled-d72bda55) (medium, CVSS 4, published 14 Oct 2026) - [Wasmtime component start function panic](https://junglewise.ai/threats/rustsec-2026-0358-yielding-in-a-component-start-function-can-lead-to-a-69829253) (medium, CVSS 4, published 14 Oct 2026) - [Wasmtime panic when pending calls are run after a trap](https://junglewise.ai/threats/rustsec-2026-0361-panic-when-pending-calls-are-run-after-a-trap-dd97c36a) (medium, CVSS 4, published 14 Oct 2026) - [Wasmtime async-entrypoint requirement enforcement bypass](https://junglewise.ai/threats/rustsec-2026-0362-wasmtime-may-not-properly-enforce-async-entrypoint-5479b21b) (medium, CVSS 4, published 14 Oct 2026) - [Wasmtime overlapping string transcode panic in fused adapter](https://junglewise.ai/threats/rustsec-2026-0360-overlapping-string-transcode-in-a-fused-adapter-can-f792eccf) (medium, CVSS 4, published 14 Oct 2026) - [RUSTSEC-2026-0356 - Panic on erroneous call-to-host from guest realloc call](https://junglewise.ai/threats/rustsec-2026-0356-panic-on-erroneous-call-to-host-from-guest-realloc-20414ed8) (low, CVSS 3.1, published 14 Oct 2026) - [Wasmtime component model panic on type mismatch viewing stream or future](https://junglewise.ai/threats/rustsec-2026-0355-panic-viewing-component-model-stream-or-future-as-the-6c786ac2) (medium, CVSS 4, published 14 Oct 2026) - [RUSTSEC-2026-0363 - Component-model handle tables are capped only per instance and charged to no limit](https://junglewise.ai/threats/rustsec-2026-0363-component-model-handle-tables-are-capped-only-per-4fad6c03) (low, CVSS 3.1, published 14 Oct 2026) - [Wasmtime panic when invoking async-lifted function via call](https://junglewise.ai/threats/rustsec-2026-0353-panic-when-invoking-an-async-lifted-function-via-call-4c2661d6) (medium, CVSS 4, published 14 Oct 2026) - [Wasmtime out-of-bounds zero-length stream writes panic](https://junglewise.ai/threats/rustsec-2026-0357-out-of-bounds-zero-length-stream-writes-can-panic-2c07c43f) (medium, CVSS 4, published 14 Oct 2026) - [Wasmtime component async-lifted callback stack buffer overflow](https://junglewise.ai/threats/rustsec-2026-0327-wasmtime-component-async-lifted-callback-result-count-c802aa47) (medium, CVSS 4, published 2 Oct 2026) - [Wasmtime WebAssembly tag import GC heap corruption](https://junglewise.ai/threats/rustsec-2026-0325-mis-typed-webassembly-tag-imports-can-lead-to-gc-heap-1482e87a) (medium, CVSS 4, published 2 Oct 2026) - [RUSTSEC-2026-0326 - Rooting for GC values live across `try_call` may be missing, causing GC heap corruption](https://junglewise.ai/threats/rustsec-2026-0326-rooting-for-gc-values-live-across-try-call-may-be-fc393416) (low, CVSS 3.1, published 2 Oct 2026) - [RUSTSEC-2026-0315 - `call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification](https://junglewise.ai/threats/rustsec-2026-0315-call-ref-and-exception-catch-can-drop-some-fuel-d2af4e0a) (low, CVSS 3.1, published 24 Sep 2026) ## Most severe wasmtime (crates.io) vulnerabilities - [CVE-2026-115893: Wasmtime Cranelift aarch64 br_table sandbox escape](https://junglewise.ai/threats/cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-115889: Wasmtime Cranelift SSA value index overflow](https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-34987: Bytecode Alliance Wasmtime sandbox escape in Winch compiler backend](https://junglewise.ai/threats/cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler) (critical, CVSS 9.9, published 9 Apr 2026) - [CVE-2026-34941: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding](https://junglewise.ai/threats/cve-2026-34941-wasmtime-heap-oob-read-in-component-model-utf-16-to-latin1-utf16) (high, CVSS 8.1, published 9 Apr 2026) - [CVE-2026-34971: Bytecode Alliance Wasmtime sandbox escape in Cranelift backend on aarch64](https://junglewise.ai/threats/cve-2026-34971-bytecode-alliance-wasmtime-sandbox-escape-in-cranelift-backend-on) (high, CVSS 7.8, published 9 Apr 2026) - [CVE-2026-44216: Bytecode Alliance Wasmtime denial of service via table allocation panic](https://junglewise.ai/threats/cve-2026-44216-bytecode-alliance-wasmtime-denial-of-service-via-table-allocation) (high, CVSS 7.5, published 14 May 2026) - [CVE-2026-34946: Wasmtime has host panic when Winch compiler executes `table.fill`](https://junglewise.ai/threats/cve-2026-34946-wasmtime-has-host-panic-when-winch-compiler-executes-table-fill) (high, CVSS 7.5, published 9 Apr 2026) - [CVE-2026-34943: Wasmtime has a possible panic when lifting `flags` component value](https://junglewise.ai/threats/cve-2026-34943-wasmtime-has-a-possible-panic-when-lifting-flags-component-value) (high, CVSS 7.5, published 9 Apr 2026) - [CVE-2026-35186: Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler](https://junglewise.ai/threats/cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler) (high, CVSS 7.5, published 9 Apr 2026) - [CVE-2026-34942: Wasmtime: Panic when transcoding misaligned utf-16 strings](https://junglewise.ai/threats/cve-2026-34942-wasmtime-panic-when-transcoding-misaligned-utf-16-strings) (medium, CVSS 6.5, published 9 Apr 2026) ## Vulnerabilities per week 21 vulnerabilities in the last four weeks, up 320% on the four before (5). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 2 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 12 | 0 | 0 | | 19 Oct 2026 | 6 | 2 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities - [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "wasmtime (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/wasmtime, 13 November 2026.