RUSTSEC-2026-0420

wasip3 UDP send can deliver a datagram to an address only allowed for receiving

Reported

October 29, 2026

Issued

October 30, 2026

Package

wasmtime-wasi (crates.io)

Type

Vulnerability

Aliases

GHSA-hmmr-87qq-258j

References

https://github.com/bytecodealliance/wasmtime/pull/15077

CVSS Score

6.4 MEDIUM

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Patched

>=48.0.8, <49.0.0
>=49.0.5, <50.0.0
>=50.0.1

Unaffected

<48.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.