https://rustsec.org/feed.xml2026-04-11T12:00:00+00:00RustSechttps://rustsec.org/favicon.icoSecurity advisories filed against Rust crateshttps://rustsec.org/advisories/RUSTSEC-2026-0097.html2026-04-11T12:00:00+00:002026-04-11T12:00:00+00:00

Rand is unsound with a custom logger using `rand::rng()`

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/rand/RUSTSEC-2026-0097.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/rand/RUSTSEC-2026-0097.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0097">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0097 </h1> <span class="subtitle"><p>Rand is unsound with a custom logger using <code>rand::rng()</code></p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-11"> April 11, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/rand.html">rand</a> (<a href="https://crates.io/crates/rand">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> <span class="tag info">INFO</span> Unsound </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/rust-random/rand/pull/1763"> https://github.com/rust-random/rand/pull/1763 </a> </li> </ul> </dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=0.10.1</code></li> <li><code>&#60;0.10.0, &#62;=0.9.3</code></li> </ul> </dd> <dt id="unaffected">Unaffected</dt> <dd> <ul> <li><code>&#60;0.7.0</code></li> </ul> </dd> </dl> <dl> <dt>Affected Functions</dt> <dd>Version</dd> <dt><code>rand::rng</code></dt> <dd> <ul> <li><code>&#62;=0.9.0</code></li> </ul> </dd> <dt><code>rand::thread_rng</code></dt> <dd> <ul> <li><code>&#60;0.10.0, &#62;=0.7.0</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>It has been reported (by @lopopolo) that the <code>rand</code> library is <a href="https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library">unsound</a> (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:</p> <ul> <li>The <code>log</code> and <code>thread_rng</code> features are enabled</li> <li>A <a href="https://docs.rs/log/latest/log/#implementing-a-logger">custom logger</a> is defined</li> <li>The custom logger accesses <code>rand::rng()</code> (previously <code>rand::thread_rng()</code>) and calls any <code>TryRng</code> (previously <code>RngCore</code>) methods on <code>ThreadRng</code></li> <li>The <code>ThreadRng</code> (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)</li> <li>Trace-level logging is enabled or warn-level logging is enabled and the random source (the <code>getrandom</code> crate) is unable to provide a new seed</li> </ul> <p><code>TryRng</code> (previously <code>RngCore</code>) methods for <code>ThreadRng</code> use <code>unsafe</code> code to cast <code>*mut BlockRng&lt;ReseedingCore&gt;</code> to <code>&amp;mut BlockRng&lt;ReseedingCore&gt;</code>. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of <a href="https://doc.rust-lang.org/stable/nomicon/references.html">aliased mutable references is Undefined Behaviour</a>, the behaviour of optimized builds is hard to predict.</p> <p>Affected versions of <code>rand</code> are <code>&gt;= 0.7, &lt; 0.9.3</code> and <code>0.10.0</code>.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0095.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0095.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0095.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0095">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0095 </h1> <span class="subtitle"><p>Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34987">CVE-2026-34987</a> </li> <li> <a href="https://github.com/advisories/GHSA-xx5w-cvp6-jv83">GHSA-xx5w-cvp6-jv83</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83 </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>9 <span class="tag critical"> CRITICAL </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>High</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>High</dd> <dt>User Interaction</dt> <dd>None</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>High</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83 For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0092.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Panic when transcoding misaligned component model UTF-16 strings

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0092.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0092.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0092">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0092 </h1> <span class="subtitle"><p>Panic when transcoding misaligned component model UTF-16 strings</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34942">CVE-2026-34942</a> </li> <li> <a href="https://github.com/advisories/GHSA-jxhv-7h78-9775">GHSA-jxhv-7h78-9775</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775 </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>5.9 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>Low</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>Passive</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=24.0.7, &#60;25.0.0</code></li> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775 For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0089.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Host panic when Winch compiler executes `table.fill`

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0089.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0089.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0089">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0089 </h1> <span class="subtitle"><p>Host panic when Winch compiler executes <code>table.fill</code></p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34946">CVE-2026-34946</a> </li> <li> <a href="https://github.com/advisories/GHSA-q49f-xg75-m9xw">GHSA-q49f-xg75-m9xw</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>5.9 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>Passive</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0096.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0096.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0096.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0096">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0096 </h1> <span class="subtitle"><p>Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34971">CVE-2026-34971</a> </li> <li> <a href="https://github.com/advisories/GHSA-jhxm-h53p-jm7w">GHSA-jhxm-h53p-jm7w</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>9 <span class="tag critical"> CRITICAL </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>High</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>High</dd> <dt>User Interaction</dt> <dd>None</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>High</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0090.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Use-after-free bug after cloning `wasmtime::Linker`

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0090.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0090.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0090">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0090 </h1> <span class="subtitle"><p>Use-after-free bug after cloning <code>wasmtime::Linker</code></p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34983">CVE-2026-34983</a> </li> <li> <a href="https://github.com/advisories/GHSA-hfr4-7c6c-48w2">GHSA-hfr4-7c6c-48w2</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2 </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>1 <span class="tag low"> LOW </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>High</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Physical</dd> <dt>Privileges Required</dt> <dd>High</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>Active</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>Low</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>Low</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>Low</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N">CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=43.0.1</code></li> </ul> </dd> <dt id="unaffected">Unaffected</dt> <dd> <ul> <li><code>&#60;43.0.0</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2 For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0088.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Data leakage between pooling allocator instances

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0088.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0088.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0088">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0088 </h1> <span class="subtitle"><p>Data leakage between pooling allocator instances</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34988">CVE-2026-34988</a> </li> <li> <a href="https://github.com/advisories/GHSA-6wgr-89rj-399p">GHSA-6wgr-89rj-399p</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>2.3 <span class="tag low"> LOW </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>High</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>Low</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>None</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>Low</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N">CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0093.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0093.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0093.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0093">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0093 </h1> <span class="subtitle"><p>Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34941">CVE-2026-34941</a> </li> <li> <a href="https://github.com/advisories/GHSA-hx6p-xpx3-jvvv">GHSA-hx6p-xpx3-jvvv</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>6.9 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>None</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>Passive</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=24.0.7, &#60;25.0.0</code></li> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0094.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Improperly masked return value from `table.grow` with Winch compiler backend

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0094.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0094.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0094">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0094 </h1> <span class="subtitle"><p>Improperly masked return value from <code>table.grow</code> with Winch compiler backend</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35186">CVE-2026-35186</a> </li> <li> <a href="https://github.com/advisories/GHSA-f984-pcp8-v2p7">GHSA-f984-pcp8-v2p7</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7 </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>6.1 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>High</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>None</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>Low</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>Low</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7 For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0086.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Host data leakage with 64-bit tables and Winch

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0086.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0086.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0086">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0086 </h1> <span class="subtitle"><p>Host data leakage with 64-bit tables and Winch</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34945">CVE-2026-34945</a> </li> <li> <a href="https://github.com/advisories/GHSA-m9w2-8782-2946">GHSA-m9w2-8782-2946</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946 </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>2.3 <span class="tag low"> LOW </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>Low</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>None</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>Low</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946 For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0091.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Out-of-bounds write or crash when transcoding component model strings

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0091.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0091.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0091">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0091 </h1> <span class="subtitle"><p>Out-of-bounds write or crash when transcoding component model strings</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35195">CVE-2026-35195</a> </li> <li> <a href="https://github.com/advisories/GHSA-394w-hwhg-8vgm">GHSA-394w-hwhg-8vgm</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>6.1 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>None</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>Low</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>Low</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=24.0.7, &#60;25.0.0</code></li> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0085.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Panic when lifting `flags` component value

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0085.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0085.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0085">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0085 </h1> <span class="subtitle"><p>Panic when lifting <code>flags</code> component value</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34943">CVE-2026-34943</a> </li> <li> <a href="https://github.com/advisories/GHSA-m758-wjhj-p3jq">GHSA-m758-wjhj-p3jq</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>5.6 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>High</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Network</dd> <dt>Privileges Required</dt> <dd>High</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>Active</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=24.0.7, &#60;25.0.0</code></li> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0087.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime/RUSTSEC-2026-0087.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime/RUSTSEC-2026-0087.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0087">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0087 </h1> <span class="subtitle"><p>Wasmtime segfault or unused out-of-sandbox load with <code>f64x2.splat</code> operator on Cranelift x86-64</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/wasmtime.html">wasmtime</a> (<a href="https://crates.io/crates/wasmtime">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="aliases">Aliases</dt> <dd> <ul> <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34944">CVE-2026-34944</a> </li> <li> <a href="https://github.com/advisories/GHSA-qqfj-4vcm-26hv">GHSA-qqfj-4vcm-26hv</a> </li> </ul> </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv"> https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv </a> </li> </ul> </dd> <dt id="cvss_score">CVSS Score</dt> <dd>4.1 <span class="tag medium"> MEDIUM </span></dd> <dt id="cvss_details">CVSS Details</dt> <dd> <dl> <dt>Attack Complexity</dt> <dd>Low</dd> <dt>Attack Requirements</dt> <dd>Present</dd> <dt>Attack Vector</dt> <dd>Local</dd> <dt>Privileges Required</dt> <dd>Low</dd> <dt>Availability Impact to the Subsequent System</dt> <dd>None</dd> <dt>Confidentiality Impact to the Subsequent System</dt> <dd>None</dd> <dt>Integrity Impact to the Subsequent System</dt> <dd>None</dd> <dt>User Interaction</dt> <dd>Active</dd> <dt>Availability Impact to the Vulnerable System</dt> <dd>High</dd> <dt>Confidentiality Impact to the Vulnerable System</dt> <dd>None</dd> <dt>Integrity Impact to the Vulnerable System</dt> <dd>None</dd> </dl> </dd> <dt id="cvss">CVSS Vector</dt> <dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></dd> <dt id="patched">Patched</dt> <dd> <ul> <li><code>&#62;=24.0.7, &#60;25.0.0</code></li> <li><code>&#62;=36.0.7, &#60;37.0.0</code></li> <li><code>&#62;=42.0.2, &#60;43.0.0</code></li> <li><code>&#62;=43.0.1</code></li> </ul> </dd> </dl> <h3 id="description">Description</h3> <p>This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv For more information see the GitHub-hosted security advisory.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0084.html2026-04-09T12:00:00+00:002026-04-09T12:00:00+00:00

`logprinter` was removed from crates.io for malicious code

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/logprinter/RUSTSEC-2026-0084.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/logprinter/RUSTSEC-2026-0084.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0084">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0084 </h1> <span class="subtitle"><p><code>logprinter</code> was removed from crates.io for malicious code</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-09"> April 9, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/logprinter.html">logprinter</a> </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://socket.dev/supply-chain-attacks/north-korea-s-contagious-interview-campaign"> https://socket.dev/supply-chain-attacks/north-korea-s-contagious-interview-campaign </a> </li> </ul> </dd> <dt id="patched">Patched</dt> <dd> no patched versions </dd> </dl> <h3 id="description">Description</h3> <p>The crate downloaded code from an external HTTP endpoint and executed it within its <code>trace()</code> fn.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0082.html2026-04-08T12:00:00+00:002026-04-08T12:00:00+00:00

zantetsu-ffi is unmaintained

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/zantetsu-ffi/RUSTSEC-2026-0082.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/zantetsu-ffi/RUSTSEC-2026-0082.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0082">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0082 </h1> <span class="subtitle"><p>zantetsu-ffi is unmaintained</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-07"> April 7, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-08"> April 8, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/zantetsu-ffi.html">zantetsu-ffi</a> (<a href="https://crates.io/crates/zantetsu-ffi">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> <span class="tag info">INFO</span> Unmaintained </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/enrell/psyche/issues/1"> https://github.com/enrell/psyche/issues/1 </a> </li> </ul> </dd> <dt id="patched">Patched</dt> <dd> no patched versions </dd> </dl> <h3 id="description">Description</h3> <p>The <code>zantetsu-ffi</code> crate is no longer maintained. The Node.js, Python, and C FFI bindings it provided were removed as part of the zantetsu 0.2 release, which refocused the project on its core Rust library.</p> <p>A tombstone version (0.2.0) has been published and 0.1.4 has been yanked. There is no replacement for <code>zantetsu-ffi</code>.</p> <h2>Migration</h2> <p>If you were using <code>zantetsu-ffi</code> for anime filename parsing, no direct equivalent is available. If your project is Rust-based, switch to <a href="https://crates.io/crates/zantetsu"><code>zantetsu 0.2</code></a>.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0083.html2026-04-08T12:00:00+00:002026-04-08T12:00:00+00:00

zantetsu-trainer is unmaintained

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/zantetsu-trainer/RUSTSEC-2026-0083.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/zantetsu-trainer/RUSTSEC-2026-0083.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0083">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0083 </h1> <span class="subtitle"><p>zantetsu-trainer is unmaintained</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-07"> April 7, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-08"> April 8, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/zantetsu-trainer.html">zantetsu-trainer</a> (<a href="https://crates.io/crates/zantetsu-trainer">crates.io</a>) </dd> <dt id="type">Type</dt> <dd> <span class="tag info">INFO</span> Unmaintained </dd> <dt id="details">References</dt> <dd> <ul> <li> <a href="https://github.com/enrell/psyche/issues/1"> https://github.com/enrell/psyche/issues/1 </a> </li> </ul> </dd> <dt id="patched">Patched</dt> <dd> no patched versions </dd> </dl> <h3 id="description">Description</h3> <p>The <code>zantetsu-trainer</code> crate is no longer maintained. The ML training infrastructure it contained was removed as part of the zantetsu 0.2 release, which replaced the neural parser with a pure heuristic engine.</p> <p>A tombstone version (0.2.0) has been published and 0.1.4 has been yanked. There is no replacement for <code>zantetsu-trainer</code>.</p> <h2>Migration</h2> <p>If you were using <code>zantetsu-trainer</code> as part of a zantetsu-based filename parsing pipeline, switch to <a href="https://crates.io/crates/zantetsu"><code>zantetsu 0.2</code></a>, which requires no training step.</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>https://rustsec.org/advisories/RUSTSEC-2026-0081.html2026-04-05T12:00:00+00:002026-04-05T12:00:00+00:00

`logtrace` was removed from crates.io for malicious code

<article> <span class="floating-menu"> <a href="https://github.com/RustSec/advisory-db/commits/main/crates/logtrace/RUSTSEC-2026-0081.md">History</a> ⋅ <a href="https://github.com/RustSec/advisory-db/edit/main/crates/logtrace/RUSTSEC-2026-0081.md">Edit</a> ⋅ <a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0081">JSON (OSV)</a> </span> <header> <h1> RUSTSEC-2026-0081 </h1> <span class="subtitle"><p><code>logtrace</code> was removed from crates.io for malicious code</p> </span> </header> <dl> <dt id="reported">Reported</dt> <dd> <time datetime="2026-04-05"> April 5, 2026 </time> </dd> <dt id="issued">Issued</dt> <dd> <time datetime="2026-04-05"> April 5, 2026 </time> </dd> <dt id="package">Package</dt> <dd> <a href="/packages/logtrace.html">logtrace</a> </dd> <dt id="type">Type</dt> <dd> Vulnerability </dd> <dt id="categories">Categories</dt> <dd> <ul> <li><a href="/categories/malicious.html">malicious</a></li> </ul> </dd> <dt id="patched">Patched</dt> <dd> no patched versions </dd> </dl> <h3 id="description">Description</h3> <p><code>logtrace</code> appeared to be downloading a RAT.</p> <p>The malicious crate had 2 versions published on 2026-04-01 that had a total of 30 downloads. There were no crates depending on this crate on crates.io.</p> <p>Thanks to <a href="https://socket.dev/">Socket.dev</a> for detecting and reporting this to the crates.io team!</p> <p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a> license. </p> </article>