[ Vendor · 17 CVEs ]
bytecodealliance
CVEs affecting bytecodealliance published in the last 30 days, plus any bytecodealliance CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115393 | 22 Oct 2026 | CVSS 3.8 | bytecodealliance wasmtimeWasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because… | |
| CVE-2026-115387 | 22 Oct 2026 | CVSS 6.2 | bytecodealliance wasmtimeWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest… | |
| CVE-2026-115388 | 22 Oct 2026 | CVSS 6.2 | bytecodealliance wasmtimewasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write… | |
| CVE-2026-115389 | 22 Oct 2026 | CVSS 2.3 | bytecodealliance wasmtimeWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values… | |
| CVE-2026-115390 | 22 Oct 2026 | CVSS 5.7 | bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths… | |
| CVE-2026-115391 | 22 Oct 2026 | CVSS 5.8 | bytecodealliance wasmtimeWasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that… | |
| CVE-2026-115392 | 22 Oct 2026 | CVSS 7.9 | bytecodealliance wasmtimeWasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi… | |
| CVE-2026-115381 | 22 Oct 2026 | CVSS 4.8 | bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2… | |
| CVE-2026-115382 | 22 Oct 2026 | CVSS 4.8 | bytecodealliance wasmtimeWasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests… | |
| CVE-2026-115383 | 22 Oct 2026 | CVSS 4.8 | bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules… | |
| CVE-2026-115384 | 22 Oct 2026 | CVSS 9.9 | bytecodealliance wasmtimeWasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to… | |
| CVE-2026-115385 | 22 Oct 2026 | CVSS 6.2 | bytecodealliance wasmtimeWasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that… | |
| CVE-2026-115386 | 22 Oct 2026 | CVSS 2.6 | bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir… | |
| CVE-2026-115379 | 22 Oct 2026 | CVSS 5.7 | bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call… | |
| CVE-2026-115380 | 22 Oct 2026 | CVSS 4.0 | bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview… | |
| CVE-2026-104855 | 2 Oct 2026 | CVSS 2.0 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM stateWasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including… | Fix |
| CVE-2026-58494 | 8 Jul 2026 | CVSS 6.5 | Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationWasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory… | Fix |