{"schema_version":1,"title":"Bytecode Alliance vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 63 vulnerabilities in Bytecode Alliance: 0 in the last 7 days and 50 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121439, was published on 3 November 2026. 43 vulnerabilities in the last four weeks, up 514% on the four before (7). 3 critical against 0. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/bytecode-alliance","json_url":"https://junglewise.ai/threats/vendors/bytecode-alliance.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/bytecode-alliance","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":6,"all_time":63,"critical":4,"exploited":0,"last_7_days":0,"last_30_days":43,"last_90_days":50,"last_365_days":61},"latest":[{"cve":"CVE-2026-121439","cvss":5.3,"slug":"cve-2026-121439-wasmtime-46-0-0-before-48-0-7-and-49-0-0-before-49-0-4-contains","title":"Wasmtime wasi-http response splitting via unvalidated headers","severity":"medium","exploited":false,"published_at":"2026-11-03T15:17:35.507+00:00","url":"https://junglewise.ai/threats/cve-2026-121439-wasmtime-46-0-0-before-48-0-7-and-49-0-0-before-49-0-4-contains"},{"cve":"CVE-2026-119143","cvss":4.8,"slug":"cve-2026-119143-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime denial of service in component model stream operations","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.967+00:00","url":"https://junglewise.ai/threats/cve-2026-119143-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119142","cvss":4.8,"slug":"cve-2026-119142-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime host panic in call_async Future drop","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.817+00:00","url":"https://junglewise.ai/threats/cve-2026-119142-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119141","cvss":5.3,"slug":"cve-2026-119141-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime denial of service in realloc handling","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.67+00:00","url":"https://junglewise.ai/threats/cve-2026-119141-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119140","cvss":4.8,"slug":"cve-2026-119140-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime denial of service via thread.yield in component start","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.52+00:00","url":"https://junglewise.ai/threats/cve-2026-119140-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119139","cvss":4.8,"slug":"cve-2026-119139-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime host crash in async-lifted function invocation","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.373+00:00","url":"https://junglewise.ai/threats/cve-2026-119139-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119138","cvss":4.8,"slug":"cve-2026-119138-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime assertion failure after trap in pending calls","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.223+00:00","url":"https://junglewise.ai/threats/cve-2026-119138-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119137","cvss":5.3,"slug":"cve-2026-119137-wasmtime-42-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime stack overflow in recursive type drops","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:07.073+00:00","url":"https://junglewise.ai/threats/cve-2026-119137-wasmtime-42-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119136","cvss":4.8,"slug":"cve-2026-119136-wasmtime-42-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime async-entrypoint enforcement bypass","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:06.913+00:00","url":"https://junglewise.ai/threats/cve-2026-119136-wasmtime-42-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"cve":"CVE-2026-119135","cvss":4.8,"slug":"cve-2026-119135-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-panics","title":"Wasmtime panic in component model stream type mismatch","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:06.757+00:00","url":"https://junglewise.ai/threats/cve-2026-119135-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-panics"},{"cve":"CVE-2026-119134","cvss":6.2,"slug":"cve-2026-119134-wasmtime-before-36-0-18-37-0-0-before-48-0-6-and-49-0-0-before","title":"Wasmtime component-model resource handle unbounded memory growth","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:06.577+00:00","url":"https://junglewise.ai/threats/cve-2026-119134-wasmtime-before-36-0-18-37-0-0-before-48-0-6-and-49-0-0-before"},{"cve":"CVE-2026-119132","cvss":4.8,"slug":"cve-2026-119132-wasmtime-from-49-0-0-before-49-0-3-contains-a-denial-of-service","title":"Wasmtime host panic via overlapping string transcode in fused adapter","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:06.26+00:00","url":"https://junglewise.ai/threats/cve-2026-119132-wasmtime-from-49-0-0-before-49-0-3-contains-a-denial-of-service"},{"cve":"CVE-2026-119131","cvss":5.3,"slug":"cve-2026-119131-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains","title":"Wasmtime denial of service in wasmtime-wasi-http","severity":"medium","exploited":false,"published_at":"2026-10-29T16:18:06.1+00:00","url":"https://junglewise.ai/threats/cve-2026-119131-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains"},{"slug":"rustsec-2026-0424-unchecked-memory-usage-in-transferring-borrowed-b297503c","title":"Wasmtime unchecked memory usage in borrowed resource transfer","severity":"info","exploited":false,"published_at":"2026-10-29T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0424-unchecked-memory-usage-in-transferring-borrowed-b297503c"},{"slug":"rustsec-2026-0423-cross-engine-type-confusion-with-host-created-struct-89fe3f0e","title":"Wasmtime type confusion with host-created struct types","severity":"info","exploited":false,"published_at":"2026-10-29T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0423-cross-engine-type-confusion-with-host-created-struct-89fe3f0e"},{"cve":"CVE-2026-118688","cvss":7.9,"slug":"cve-2026-118688-wasmtime-wasi-in-wasmtime-before-36-0-18-37-0-0-before-48-0-6","title":"Wasmtime filesystem sandbox escape via symlink rename","severity":"high","exploited":false,"published_at":"2026-10-28T19:17:35.973+00:00","url":"https://junglewise.ai/threats/cve-2026-118688-wasmtime-wasi-in-wasmtime-before-36-0-18-37-0-0-before-48-0-6"},{"cve":"CVE-2026-115893","cvss":9.9,"epss":0.0099,"slug":"cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7","title":"Wasmtime Cranelift aarch64 br_table sandbox escape","severity":"critical","exploited":false,"published_at":"2026-10-23T22:16:58.82+00:00","url":"https://junglewise.ai/threats/cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7"},{"cve":"CVE-2026-115892","cvss":4,"epss":0.0043,"slug":"cve-2026-115892-wasmtime-is-a-runtime-for-webassembly-from-46-0-0-until-48-0-7","title":"Wasmtime component-model type-check bypass in stream/future lowering","severity":"medium","exploited":false,"published_at":"2026-10-23T22:16:58.633+00:00","url":"https://junglewise.ai/threats/cve-2026-115892-wasmtime-is-a-runtime-for-webassembly-from-46-0-0-until-48-0-7"},{"cve":"CVE-2026-115889","cvss":9.9,"epss":0.0045,"slug":"cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0","title":"Wasmtime Cranelift SSA value index overflow","severity":"critical","exploited":false,"published_at":"2026-10-23T22:16:58.4+00:00","url":"https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0"},{"cve":"CVE-2026-115392","cvss":7.9,"slug":"cve-2026-115392-wasmtime-before-24-0-13-25-0-0-before-36-0-14-37-0-0-before-46-0","title":"Wasmtime filesystem sandbox escape via symlink trailing slashes","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:46.863+00:00","url":"https://junglewise.ai/threats/cve-2026-115392-wasmtime-before-24-0-13-25-0-0-before-36-0-14-37-0-0-before-46-0"},{"cve":"CVE-2026-115391","cvss":5.8,"slug":"cve-2026-115391-wasmtime-46-0-0-before-46-0-3-and-47-0-0-before-47-0-4-contains","title":"Wasmtime WASIp3 uncontrolled resource allocation in streams","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:46.703+00:00","url":"https://junglewise.ai/threats/cve-2026-115391-wasmtime-46-0-0-before-46-0-3-and-47-0-0-before-47-0-4-contains"},{"cve":"CVE-2026-115390","cvss":5.7,"slug":"cve-2026-115390-wasmtime-47-0-0-before-48-0-3-and-49-0-0-before-49-0-1-contains","title":"Wasmtime fuel accounting bypass in call_ref and try_table","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:46.51+00:00","url":"https://junglewise.ai/threats/cve-2026-115390-wasmtime-47-0-0-before-48-0-3-and-49-0-0-before-49-0-1-contains"},{"cve":"CVE-2026-115388","cvss":6.2,"slug":"cve-2026-115388-wasmtime-wasi-http-in-wasmtime-before-36-0-16-37-0-0-before-48-0","title":"Wasmtime wasmtime-wasi-http memory exhaustion in HTTP body write","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:46.173+00:00","url":"https://junglewise.ai/threats/cve-2026-115388-wasmtime-wasi-http-in-wasmtime-before-36-0-16-37-0-0-before-48-0"},{"cve":"CVE-2026-115387","cvss":6.2,"slug":"cve-2026-115387-wasmtime-before-36-0-16-37-0-0-before-48-0-3-and-49-0-0-before","title":"Wasmtime denial of service via WASI filesystem timestamp overflow","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:46.01+00:00","url":"https://junglewise.ai/threats/cve-2026-115387-wasmtime-before-36-0-16-37-0-0-before-48-0-3-and-49-0-0-before"},{"cve":"CVE-2026-115385","cvss":6.2,"slug":"cve-2026-115385-wasmtime-46-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains","title":"Wasmtime denial of service in WASIp3 timestamp handling","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:45.697+00:00","url":"https://junglewise.ai/threats/cve-2026-115385-wasmtime-46-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains"}],"vendor":{"hub":true,"name":"Bytecode Alliance","slug":"bytecode-alliance","homepage":"https://bytecodealliance.org","description":"Non-profit organization focused on developing and standardizing WebAssembly and related technologies.","url":"https://junglewise.ai/threats/vendors/bytecode-alliance"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":11},{"week":"2026-10-19","critical":3,"exploited":0,"vulnerabilities":16},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":15},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-115893","cvss":9.9,"epss":0.0099,"slug":"cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7","title":"Wasmtime Cranelift aarch64 br_table sandbox escape","severity":"critical","exploited":false,"published_at":"2026-10-23T22:16:58.82+00:00","url":"https://junglewise.ai/threats/cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7"},{"cve":"CVE-2026-115889","cvss":9.9,"epss":0.0045,"slug":"cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0","title":"Wasmtime Cranelift SSA value index overflow","severity":"critical","exploited":false,"published_at":"2026-10-23T22:16:58.4+00:00","url":"https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0"},{"cve":"CVE-2026-34987","cvss":9.9,"epss":0.0028,"slug":"cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler","title":"Bytecode Alliance Wasmtime sandbox escape in Winch compiler backend","severity":"critical","exploited":false,"published_at":"2026-04-09T19:16:25+00:00","url":"https://junglewise.ai/threats/cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler"},{"cve":"CVE-2026-115384","cvss":9.9,"slug":"cve-2026-115384-wasmtime-39-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains","title":"Wasmtime stack buffer overflow in component async callbacks","severity":"critical","exploited":false,"published_at":"2026-10-22T19:17:45.543+00:00","url":"https://junglewise.ai/threats/cve-2026-115384-wasmtime-39-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains"},{"cve":"CVE-2026-118688","cvss":7.9,"slug":"cve-2026-118688-wasmtime-wasi-in-wasmtime-before-36-0-18-37-0-0-before-48-0-6","title":"Wasmtime filesystem sandbox escape via symlink rename","severity":"high","exploited":false,"published_at":"2026-10-28T19:17:35.973+00:00","url":"https://junglewise.ai/threats/cve-2026-118688-wasmtime-wasi-in-wasmtime-before-36-0-18-37-0-0-before-48-0-6"},{"cve":"CVE-2026-115392","cvss":7.9,"slug":"cve-2026-115392-wasmtime-before-24-0-13-25-0-0-before-36-0-14-37-0-0-before-46-0","title":"Wasmtime filesystem sandbox escape via symlink trailing slashes","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:46.863+00:00","url":"https://junglewise.ai/threats/cve-2026-115392-wasmtime-before-24-0-13-25-0-0-before-36-0-14-37-0-0-before-46-0"},{"cve":"CVE-2026-34971","cvss":7.8,"epss":0.0039,"slug":"cve-2026-34971-bytecode-alliance-wasmtime-sandbox-escape-in-cranelift-backend-on","title":"Bytecode Alliance Wasmtime sandbox escape in Cranelift backend on aarch64","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:24.663+00:00","url":"https://junglewise.ai/threats/cve-2026-34971-bytecode-alliance-wasmtime-sandbox-escape-in-cranelift-backend-on"},{"cve":"CVE-2026-44216","cvss":7.5,"epss":0.0058,"slug":"cve-2026-44216-bytecode-alliance-wasmtime-denial-of-service-via-table-allocation","title":"Bytecode Alliance Wasmtime denial of service via table allocation panic","severity":"high","exploited":false,"published_at":"2026-05-14T15:16:47.793+00:00","url":"https://junglewise.ai/threats/cve-2026-44216-bytecode-alliance-wasmtime-denial-of-service-via-table-allocation"},{"cve":"CVE-2026-47261","cvss":7.5,"epss":0.005,"slug":"cve-2026-47261-bytecode-alliance-wasmtime-access-control-bypass-in-wasmtime-wasi","title":"Bytecode Alliance Wasmtime access control bypass in wasmtime-wasi","severity":"high","exploited":false,"published_at":"2026-06-15T21:17:11.153+00:00","url":"https://junglewise.ai/threats/cve-2026-47261-bytecode-alliance-wasmtime-access-control-bypass-in-wasmtime-wasi"},{"cve":"CVE-2026-35186","cvss":7.5,"epss":0.0021,"slug":"cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler","title":"Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:25.343+00:00","url":"https://junglewise.ai/threats/cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler"}],"generated_at":"2026-11-11T03:07:00.183524+00:00","technologies":[{"name":"Bytecode Alliance Wasmtime","slug":"bytecode-alliance-wasmtime","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/bytecode-alliance-wasmtime"},{"name":"Bytecode Alliance Wasmtime-Wasi","slug":"bytecode-alliance-wasmtime-wasi","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/bytecode-alliance-wasmtime-wasi"}]}