Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: bytecodealliance wasmtime 36.0.17, 48.0.4, 49.0.2 Clear all filters
TI-2026-79471 CVE-2026-115386 · GHSA-7vfm-vg2r-wpmh

Wasmtime fd_readdir discloses uninitialized host memory to guests

Priority LOW 11

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00197 Published 2026-10-22 Partial fix · 36.0.17, 48.0.4 +1 CWE-908
TI-2026-79466 CVE-2026-115381 · GHSA-m3j5-9cx2-7c68

Unbounded memory allocation in Wasmtime SinkOutputStream write-zeroes

Priority LOW 26

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/std…

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00212 Published 2026-10-22 Fixed in 36.0.17, 48.0.4 +1 CWE-770
TI-2026-79465 CVE-2026-115380 · GHSA-85gj-cvfx-w74q

Resource exhaustion in Wasmtime WASI poll_oneoff ignores fuel limits

Priority LOW 22

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription w…

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00118 Published 2026-10-22 Fixed in 36.0.17, 48.0.4 +1 CWE-770