RUSTSEC-2026-0378

Panic lowering a host-created component model stream into a guest that expects a different payload type

Reported

October 19, 2026

Issued

October 20, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-9pvw-hwfg-92h5

References

https://github.com/bytecodealliance/wasmtime/pull/14827

CVSS Score

5.7 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: High
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.7, <49.0.0
>=49.0.4

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.