Vulnerability-Lookup

OPENSUSE-SU-2026:10715-1

Vulnerability from csaf_opensuse - Published: 2026-05-06 00:00 - Updated: 2026-05-06 00:00

Summary

libtree-sitter0_26-0.26.8-2.1 on GA media

Severity

Moderate

Notes

Title of the patch: libtree-sitter0_26-0.26.8-2.1 on GA media

Description of the patch: These are all security issues fixed in the libtree-sitter0_26-0.26.8-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10715

CVE-2026-34941

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-34943

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-34988

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-35186

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/o…	self
	https://www.suse.com/security/cve/CVE-2026-34941/	self
	https://www.suse.com/security/cve/CVE-2026-34943/	self
	https://www.suse.com/security/cve/CVE-2026-34988/	self
	https://www.suse.com/security/cve/CVE-2026-35186/	self
	https://www.suse.com/security/cve/CVE-2026-34941	external
	https://bugzilla.suse.com/1261869	external
	https://www.suse.com/security/cve/CVE-2026-34943	external
	https://bugzilla.suse.com/1261951	external
	https://www.suse.com/security/cve/CVE-2026-34988	external
	https://bugzilla.suse.com/1261966	external
	https://www.suse.com/security/cve/CVE-2026-35186	external
	https://bugzilla.suse.com/1262034	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libtree-sitter0_26-0.26.8-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libtree-sitter0_26-0.26.8-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10715",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10715-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34941 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34941/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34943 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34943/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34988 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34988/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-35186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-35186/"
      }
    ],
    "title": "libtree-sitter0_26-0.26.8-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-05-06T00:00:00Z",
      "generator": {
        "date": "2026-05-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10715-1",
      "initial_release_date": "2026-05-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-0.26.8-2.1.aarch64",
                "product": {
                  "name": "libtree-sitter0_26-0.26.8-2.1.aarch64",
                  "product_id": "libtree-sitter0_26-0.26.8-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
                "product": {
                  "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
                  "product_id": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-0.26.8-2.1.aarch64",
                "product": {
                  "name": "tree-sitter-0.26.8-2.1.aarch64",
                  "product_id": "tree-sitter-0.26.8-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-devel-0.26.8-2.1.aarch64",
                "product": {
                  "name": "tree-sitter-devel-0.26.8-2.1.aarch64",
                  "product_id": "tree-sitter-devel-0.26.8-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-0.26.8-2.1.ppc64le",
                "product": {
                  "name": "libtree-sitter0_26-0.26.8-2.1.ppc64le",
                  "product_id": "libtree-sitter0_26-0.26.8-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
                "product": {
                  "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
                  "product_id": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-0.26.8-2.1.ppc64le",
                "product": {
                  "name": "tree-sitter-0.26.8-2.1.ppc64le",
                  "product_id": "tree-sitter-0.26.8-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-devel-0.26.8-2.1.ppc64le",
                "product": {
                  "name": "tree-sitter-devel-0.26.8-2.1.ppc64le",
                  "product_id": "tree-sitter-devel-0.26.8-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-0.26.8-2.1.s390x",
                "product": {
                  "name": "libtree-sitter0_26-0.26.8-2.1.s390x",
                  "product_id": "libtree-sitter0_26-0.26.8-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
                "product": {
                  "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
                  "product_id": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-0.26.8-2.1.s390x",
                "product": {
                  "name": "tree-sitter-0.26.8-2.1.s390x",
                  "product_id": "tree-sitter-0.26.8-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-devel-0.26.8-2.1.s390x",
                "product": {
                  "name": "tree-sitter-devel-0.26.8-2.1.s390x",
                  "product_id": "tree-sitter-devel-0.26.8-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-0.26.8-2.1.x86_64",
                "product": {
                  "name": "libtree-sitter0_26-0.26.8-2.1.x86_64",
                  "product_id": "libtree-sitter0_26-0.26.8-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
                "product": {
                  "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
                  "product_id": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-0.26.8-2.1.x86_64",
                "product": {
                  "name": "tree-sitter-0.26.8-2.1.x86_64",
                  "product_id": "tree-sitter-0.26.8-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tree-sitter-devel-0.26.8-2.1.x86_64",
                "product": {
                  "name": "tree-sitter-devel-0.26.8-2.1.x86_64",
                  "product_id": "tree-sitter-devel-0.26.8-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-0.26.8-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64"
        },
        "product_reference": "libtree-sitter0_26-0.26.8-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-0.26.8-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le"
        },
        "product_reference": "libtree-sitter0_26-0.26.8-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-0.26.8-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x"
        },
        "product_reference": "libtree-sitter0_26-0.26.8-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-0.26.8-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64"
        },
        "product_reference": "libtree-sitter0_26-0.26.8-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64"
        },
        "product_reference": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le"
        },
        "product_reference": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x"
        },
        "product_reference": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64"
        },
        "product_reference": "libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-0.26.8-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64"
        },
        "product_reference": "tree-sitter-0.26.8-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-0.26.8-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le"
        },
        "product_reference": "tree-sitter-0.26.8-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-0.26.8-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x"
        },
        "product_reference": "tree-sitter-0.26.8-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-0.26.8-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64"
        },
        "product_reference": "tree-sitter-0.26.8-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-devel-0.26.8-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64"
        },
        "product_reference": "tree-sitter-devel-0.26.8-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-devel-0.26.8-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le"
        },
        "product_reference": "tree-sitter-devel-0.26.8-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-devel-0.26.8-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x"
        },
        "product_reference": "tree-sitter-devel-0.26.8-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tree-sitter-devel-0.26.8-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
        },
        "product_reference": "tree-sitter-devel-0.26.8-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34941",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34941"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly\u0027s linear memory in an attempt to transcode nonexistent bytes. In Wasmtime\u0027s default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34941",
          "url": "https://www.suse.com/security/cve/CVE-2026-34941"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261869 for CVE-2026-34941",
          "url": "https://bugzilla.suse.com/1261869"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34941"
    },
    {
      "cve": "CVE-2026-34943",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34943"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime\u0027s implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34943",
          "url": "https://www.suse.com/security/cve/CVE-2026-34943"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261951 for CVE-2026-34943",
          "url": "https://bugzilla.suse.com/1261951"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34943"
    },
    {
      "cve": "CVE-2026-34988",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34988"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime\u0027s implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the virtual memory permissions for linear memory used the wrong predicate to determine if resetting was necessary, where the compilation process used a different predicate. This divergence meant that the pooling allocator incorrectly deduced at runtime that resetting virtual memory permissions was not necessary while compile-time determine that virtual memory could be relied upon. The pooling allocator must be in use, Config::memory_guard_size configuration option must be 0, Config::memory_reservation configuration must be less than 4GiB, and pooling allocator must be configured with max_memory_size the same as the memory_reservation value in order to exploit this vulnerability. If all of these conditions are applicable then when a linear memory is reused the VM permissions of the previous iteration are not reset. This means that the compiled code, which is assuming out-of-bounds loads will segfault, will not actually segfault and can read the previous contents of linear memory if it was previously mapped. This represents a data leakage vulnerability between guest WebAssembly instances which breaks WebAssembly\u0027s semantics and additionally breaks the sandbox that Wasmtime provides. Wasmtime is not vulnerable to this issue with its default settings, nor with the default settings of the pooling allocator, but embeddings are still allowed to configure these values to cause this vulnerability. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34988",
          "url": "https://www.suse.com/security/cve/CVE-2026-34988"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261966 for CVE-2026-34988",
          "url": "https://bugzilla.suse.com/1261966"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34988"
    },
    {
      "cve": "CVE-2026-35186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-35186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime\u0027s Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch\u0027s compiler state compounds into further issues depending on how the value is consumed. The primary consequence of this bug is that bytes in the host\u0027s address space can be stored/read from. This is only applicable to the 16 bytes before linear memory, however, as the only significant return value of table.grow that can be misinterpreted is -1. The bytes before linear memory are, by default, unmapped memory. Wasmtime will detect this fault and abort the process, however, because wasm should not be able to access these bytes. Overall this this bug in Winch represents a DoS vector by crashing the host process, a correctness issue within Winch, and a possible leak of up to 16-bytes before linear memory. Wasmtime\u0027s default compiler is Cranelift, not Winch, and Wasmtime\u0027s default settings are to place guard pages before linear memory. This means that Wasmtime\u0027s default configuration is not affected by this issue, and when explicitly choosing Winch Wasmtime\u0027s otherwise default configuration leads to a DoS. Disabling guard pages before linear memory is required to possibly leak up to 16-bytes of host data. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
          "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-35186",
          "url": "https://www.suse.com/security/cve/CVE-2026-35186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262034 for CVE-2026-35186",
          "url": "https://bugzilla.suse.com/1262034"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:libtree-sitter0_26-x86-64-v3-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-0.26.8-2.1.x86_64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.aarch64",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.ppc64le",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.s390x",
            "openSUSE Tumbleweed:tree-sitter-devel-0.26.8-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-35186"
    }
  ]
}

CVE-2026-35186 (GCVE-0-2026-35186)

Vulnerability from cvelistv5 – Published: 2026-04-09 18:54 – Updated: 2026-04-13 20:18

Title

Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

Summary

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch's compiler state compounds into further issues depending on how the value is consumed. The primary consequence of this bug is that bytes in the host's address space can be stored/read from. This is only applicable to the 16 bytes before linear memory, however, as the only significant return value of table.grow that can be misinterpreted is -1. The bytes before linear memory are, by default, unmapped memory. Wasmtime will detect this fault and abort the process, however, because wasm should not be able to access these bytes. Overall this this bug in Winch represents a DoS vector by crashing the host process, a correctness issue within Winch, and a possible leak of up to 16-bytes before linear memory. Wasmtime's default compiler is Cranelift, not Winch, and Wasmtime's default settings are to place guard pages before linear memory. This means that Wasmtime's default configuration is not affected by this issue, and when explicitly choosing Winch Wasmtime's otherwise default configuration leads to a DoS. Disabling guard pages before linear memory is required to possibly leak up to 16-bytes of host data. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Severity ?

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M

References

URL

Tags

https://github.com/bytecodealliance/wasmtime/secu…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	bytecodealliance	wasmtime	Affected: >= 25.0.0, < 36.0.7 Affected: >= 37.0.0, < 42.0.2 Affected: >= 43.0.0, < 44.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-35186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T20:17:58.130808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T20:18:21.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 25.0.0, \u003c 36.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0, \u003c 42.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 43.0.0, \u003c 44.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime\u0027s Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch\u0027s compiler state compounds into further issues depending on how the value is consumed. The primary consequence of this bug is that bytes in the host\u0027s address space can be stored/read from. This is only applicable to the 16 bytes before linear memory, however, as the only significant return value of table.grow that can be misinterpreted is -1. The bytes before linear memory are, by default, unmapped memory. Wasmtime will detect this fault and abort the process, however, because wasm should not be able to access these bytes. Overall this this bug in Winch represents a DoS vector by crashing the host process, a correctness issue within Winch, and a possible leak of up to 16-bytes before linear memory. Wasmtime\u0027s default compiler is Cranelift, not Winch, and Wasmtime\u0027s default settings are to place guard pages before linear memory. This means that Wasmtime\u0027s default configuration is not affected by this issue, and when explicitly choosing Winch Wasmtime\u0027s otherwise default configuration leads to a DoS. Disabling guard pages before linear memory is required to possibly leak up to 16-bytes of host data. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T18:54:48.760Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7"
        }
      ],
      "source": {
        "advisory": "GHSA-f984-pcp8-v2p7",
        "discovery": "UNKNOWN"
      },
      "title": "Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35186",
    "datePublished": "2026-04-09T18:54:48.760Z",
    "dateReserved": "2026-04-01T17:26:21.134Z",
    "dateUpdated": "2026-04-13T20:18:21.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34941 (GCVE-0-2026-34941)

Vulnerability from cvelistv5 – Published: 2026-04-09 18:29 – Updated: 2026-04-10 14:11

Title

Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Summary

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M

References

URL

Tags

https://github.com/bytecodealliance/wasmtime/secu…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	bytecodealliance	wasmtime	Affected: < 24.0.7 Affected: >= 25.0.0, < 36.0.7 Affected: >= 37.0.0, < 42.0.2 Affected: >= 43.0.0, < 44.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34941",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T14:11:45.884099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T14:11:52.558Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 24.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 25.0.0, \u003c 36.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0, \u003c 42.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 43.0.0, \u003c 44.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly\u0027s linear memory in an attempt to transcode nonexistent bytes. In Wasmtime\u0027s default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T18:29:30.730Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv"
        }
      ],
      "source": {
        "advisory": "GHSA-hx6p-xpx3-jvvv",
        "discovery": "UNKNOWN"
      },
      "title": "Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34941",
    "datePublished": "2026-04-09T18:29:30.730Z",
    "dateReserved": "2026-03-31T17:27:08.660Z",
    "dateUpdated": "2026-04-10T14:11:52.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34988 (GCVE-0-2026-34988)

Vulnerability from cvelistv5 – Published: 2026-04-09 18:52 – Updated: 2026-04-09 19:31

Title

Wasmtime leaks data between pooling allocator instances

Summary

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the virtual memory permissions for linear memory used the wrong predicate to determine if resetting was necessary, where the compilation process used a different predicate. This divergence meant that the pooling allocator incorrectly deduced at runtime that resetting virtual memory permissions was not necessary while compile-time determine that virtual memory could be relied upon. The pooling allocator must be in use, Config::memory_guard_size configuration option must be 0, Config::memory_reservation configuration must be less than 4GiB, and pooling allocator must be configured with max_memory_size the same as the memory_reservation value in order to exploit this vulnerability. If all of these conditions are applicable then when a linear memory is reused the VM permissions of the previous iteration are not reset. This means that the compiled code, which is assuming out-of-bounds loads will segfault, will not actually segfault and can read the previous contents of linear memory if it was previously mapped. This represents a data leakage vulnerability between guest WebAssembly instances which breaks WebAssembly's semantics and additionally breaks the sandbox that Wasmtime provides. Wasmtime is not vulnerable to this issue with its default settings, nor with the default settings of the pooling allocator, but embeddings are still allowed to configure these values to cause this vulnerability. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Severity ?

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

GitHub_M

References

URL

Tags

https://github.com/bytecodealliance/wasmtime/secu…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	bytecodealliance	wasmtime	Affected: >= 28.0.0, < 36.0.7 Affected: >= 37.0.0, < 42.0.2 Affected: >= 43.0.0, < 44.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T19:30:55.518033Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T19:31:07.544Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 28.0.0, \u003c 36.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0, \u003c 42.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 43.0.0, \u003c 44.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime\u0027s implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the virtual memory permissions for linear memory used the wrong predicate to determine if resetting was necessary, where the compilation process used a different predicate. This divergence meant that the pooling allocator incorrectly deduced at runtime that resetting virtual memory permissions was not necessary while compile-time determine that virtual memory could be relied upon. The pooling allocator must be in use, Config::memory_guard_size configuration option must be 0, Config::memory_reservation configuration must be less than 4GiB, and pooling allocator must be configured with max_memory_size the same as the memory_reservation value in order to exploit this vulnerability. If all of these conditions are applicable then when a linear memory is reused the VM permissions of the previous iteration are not reset. This means that the compiled code, which is assuming out-of-bounds loads will segfault, will not actually segfault and can read the previous contents of linear memory if it was previously mapped. This represents a data leakage vulnerability between guest WebAssembly instances which breaks WebAssembly\u0027s semantics and additionally breaks the sandbox that Wasmtime provides. Wasmtime is not vulnerable to this issue with its default settings, nor with the default settings of the pooling allocator, but embeddings are still allowed to configure these values to cause this vulnerability. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T18:52:26.131Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p"
        }
      ],
      "source": {
        "advisory": "GHSA-6wgr-89rj-399p",
        "discovery": "UNKNOWN"
      },
      "title": "Wasmtime leaks data between pooling allocator instances"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34988",
    "datePublished": "2026-04-09T18:52:26.131Z",
    "dateReserved": "2026-03-31T19:38:31.617Z",
    "dateUpdated": "2026-04-09T19:31:07.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34943 (GCVE-0-2026-34943)

Vulnerability from cvelistv5 – Published: 2026-04-09 18:36 – Updated: 2026-04-13 20:15

Title

Wasmtime panics when lifting `flags` component value

Summary

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Severity ?

5.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M

References

URL

Tags

https://github.com/bytecodealliance/wasmtime/secu…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	bytecodealliance	wasmtime	Affected: < 24.0.7 Affected: >= 25.0.0, < 36.0.7 Affected: >= 37.0.0, < 42.0.2 Affected: >= 43.0.0, < 44.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34943",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T20:15:13.926993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T20:15:23.994Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 24.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 25.0.0, \u003c 36.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0, \u003c 42.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 43.0.0, \u003c 44.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime\u0027s implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T18:36:51.370Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq"
        }
      ],
      "source": {
        "advisory": "GHSA-m758-wjhj-p3jq",
        "discovery": "UNKNOWN"
      },
      "title": "Wasmtime panics when lifting `flags` component value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34943",
    "datePublished": "2026-04-09T18:36:51.370Z",
    "dateReserved": "2026-03-31T17:27:08.660Z",
    "dateUpdated": "2026-04-13T20:15:23.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10715-1

CVE-2026-35186 (GCVE-0-2026-35186)

CVE-2026-34941 (GCVE-0-2026-34941)

CVE-2026-34988 (GCVE-0-2026-34988)

CVE-2026-34943 (GCVE-0-2026-34943)

Tags

Sightings

Nomenclature