Wasmtime_jll
JLSEC-2026-1368Medium 6.5UpstreamNo summary availableJLSEC-2026-1367Low 2.3UpstreamNo summary availableJLSEC-2026-1366High 7.5Upstreamwasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictionJLSEC-2026-1365Medium 5.9Upstreamwasmtime has a panic when allocating a table exceeding the size of the host's address spa…JLSEC-2026-1364Medium 6.1UpstreamWasmtime has out-of-bounds write or crash when transcoding component model stringsJLSEC-2026-1363Medium 6.1UpstreamWasmtime has improperly masked return value from `table.grow` with Winch compiler backendJLSEC-2026-1362Low 2.3UpstreamWasmtime has data leakage between pooling allocator instancesJLSEC-2026-1361Critical 9.0UpstreamWasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory accessJLSEC-2026-1360Critical 9.0UpstreamWasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 CraneliftJLSEC-2026-1359Medium 5.9UpstreamWasmtime has host panic when Winch compiler executes `table.fill`JLSEC-2026-1358Low 2.3UpstreamWasmtime has host data leakage with 64-bit tables and WinchJLSEC-2026-1357Medium 4.1UpstreamWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64JLSEC-2026-1356Medium 5.6UpstreamWasmtime has a possible panic when lifting `flags` component valueJLSEC-2026-1355Medium 5.9UpstreamWasmtime: Panic when transcoding misaligned utf-16 stringsJLSEC-2026-1354Medium 6.9UpstreamWasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcodingJLSEC-2026-1353Medium 6.9UpstreamWasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instanceJLSEC-2026-1352Medium 6.9UpstreamWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionJLSEC-2026-1351Medium 6.9UpstreamWasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` futureJLSEC-2026-1350Low 1.8UpstreamWasmtime provides unsound API access to a WebAssembly shared linear memoryJLSEC-2026-1349Low 3.5UpstreamWasmtime CLI is vulnerable to host panic through its fd_renumber functionJLSEC-2026-1348Low 2.3UpstreamWasmtime doesn't fully sandbox all the Windows device filenames