TI-2026-27167 Aliases CVE-2026-34943 GHSA-m758-wjhj-p3jq

Wasmtime panics when lifting `flags` component value

LOW 31CWE-248Published 2026-04-09 · Updated 2026-04-13

Key facts

Attack vector: Network
Privileges required: High
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00336 27th percentileScored 2026-11-07

Fix Partial wasmtime (bytecodealliance): 24.0.7, 36.0.7, 42.0.2 +1wasmtime (crates.io): 24.0.7, 36.0.7, 42.0.2 +1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bytecodealliance	wasmtime	before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.1	24.0.7, 36.0.7, 42.0.2, 44.0.1	Patch available	CNA
—	wasmtime (crates.io)	before 24.0.7	24.0.7	Patch available	GHSA-m758-wjhj-p3jq
—	wasmtime (crates.io)	25.0.0 to before 36.0.7	36.0.7	Patch available	GHSA-m758-wjhj-p3jq
—	wasmtime (crates.io)	37.0.0 to before 42.0.2	42.0.2	Patch available	GHSA-m758-wjhj-p3jq
—	wasmtime (crates.io)	43.0.0 to before 43.0.1	43.0.1	Patch available	GHSA-m758-wjhj-p3jq

wasmtime Vendorbytecodealliance Affected before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.1 Fixed in 24.0.7, 36.0.7, 42.0.2, 44.0.1 Patch available CNA
wasmtime (crates.io) Vendor— Affected before 24.0.7 Fixed in 24.0.7 Patch available GHSA-m758-wjhj-p3jq
wasmtime (crates.io) Vendor— Affected 25.0.0 to before 36.0.7 Fixed in 36.0.7 Patch available GHSA-m758-wjhj-p3jq
wasmtime (crates.io) Vendor— Affected 37.0.0 to before 42.0.2 Fixed in 42.0.2 Patch available GHSA-m758-wjhj-p3jq
wasmtime (crates.io) Vendor— Affected 43.0.0 to before 43.0.1 Fixed in 43.0.1 Patch available GHSA-m758-wjhj-p3jq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bytecodealliance:wasmtime::::::rust::*	before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1	Vulnerable	bytecodealliance

cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1 Vulnerable ·bytecodealliance

Remediation

Fix · CNA wasmtime (bytecodealliance) Fixed in 24.0.7, 36.0.7, 42.0.2, 44.0.1
Fix · GHSA-m758-wjhj-p3jq wasmtime (crates.io) Fixed in 24.0.7 Advisory →
Fix · GHSA-m758-wjhj-p3jq wasmtime (crates.io) Fixed in 36.0.7 Advisory →
Fix · GHSA-m758-wjhj-p3jq wasmtime (crates.io) Fixed in 42.0.2 Advisory →
Fix · GHSA-m758-wjhj-p3jq wasmtime (crates.io) Fixed in 43.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Connectivity Link 1	Affected	No fix yet

Not affected: 1 product

Red Hat Enterprise Linux 10

Timeline

2026-10-02 Threatist record created from CVE-2026-34943
2026-10-03 Alias added: GHSA-m758-wjhj-p3jq

References

Advisory 2

Other 2

TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences