Hi,
The following vulnerabilities were published for rust-wasmtime.
CVE-2026-115380[0]:
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before
| 49.0.2 contains a denial of service vulnerability in the wasmtime-
| wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host
| work per subscription without consuming or checking fuel. Malicious
| guest modules can pass many subscriptions to force long-running host
| computation that ignores configured fuel limits.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm
CVE-2026-115381[1]:
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before
| 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi
| WASIp2 write-zeroes method of SinkOutputStream, the default stream
| used when stdout/stderr are not configured. A malicious WebAssembly
| guest can request huge zero-filled writes, exhausting host memory
| and causing denial of service.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
CVE-2026-115386[2]:
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before
| 49.0.2 contains an information disclosure vulnerability in the
| WASIp1 fd_readdir implementation that copies uninitialized struct
| padding into guest memory. Guests with a preopened directory can
| list entries to receive three bytes of leftover host stack or heap
| memory per directory entry.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24
CVE-2026-115387[3]:
| Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before
| 49.0.1 contains a denial of service vulnerability in wasmtime-wasi
| that allows guest WASI programs to panic the host via overflowing
| filesystem timestamps. Attackers can pass atim or mtim values whose
| sub-second field overflows the seconds field to
| path_filestat_set_times, fd_filestat_set_times, set-times, or set-
| times-at, crashing the host.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h
CVE-2026-115389[4]:
| Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before
| 49.0.1 does not adequately account for host allocations when lifting
| guest values through the dynamically-typed Val API, bypassing the
| hostcall fuel limit. A malicious WebAssembly guest can return
| crafted values that allocate at least ~100x more host memory than
| tracked, causing denial of service.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr
https://rustsec.org/advisories/RUSTSEC-2026-0316.html
https://github.com/bytecodealliance/wasmtime/pull/14415
CVE-2026-115392[5]:
| Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before
| 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape
| in wasmtime-wasi because its cap-std dependency mishandles symlinks
| with trailing slashes on macOS and Linux kernels lacking openat2. A
| guest with write access to any sandboxed directory can read and
| write any host-accessible file, and read-only guests may read host
| files via preexisting symlinks.
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg
https://rustsec.org/advisories/RUSTSEC-2026-0269.html
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-115380
https://www.cve.org/CVERecord?id=CVE-2026-115380
[1] https://security-tracker.debian.org/tracker/CVE-2026-115381
https://www.cve.org/CVERecord?id=CVE-2026-115381
[2] https://security-tracker.debian.org/tracker/CVE-2026-115386
https://www.cve.org/CVERecord?id=CVE-2026-115386
[3] https://security-tracker.debian.org/tracker/CVE-2026-115387
https://www.cve.org/CVERecord?id=CVE-2026-115387
[4] https://security-tracker.debian.org/tracker/CVE-2026-115389
https://www.cve.org/CVERecord?id=CVE-2026-115389
[5] https://security-tracker.debian.org/tracker/CVE-2026-115392
https://www.cve.org/CVERecord?id=CVE-2026-115392
Please adjust the affected versions in the BTS as needed.