RUSTSEC-2026-0022

Panic when dropping a [Typed]Func::call_async future

Reported

February 24, 2026

Issued

February 24, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

References

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94

CVSS Score

6.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: High
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Patched

>=40.0.4, <41.0.0
>=41.0.4

Unaffected

<39.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.