GHSA-jxhv-7h78-9775

Suggest an improvement
Source
https://github.com/advisories/GHSA-jxhv-7h78-9775
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jxhv-7h78-9775/GHSA-jxhv-7h78-9775.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jxhv-7h78-9775
Aliases
Published
2026-04-09T20:22:12Z
Modified
2026-04-09T21:46:47.707979Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L CVSS Calculator
Summary
Wasmtime: Panic when transcoding misaligned utf-16 strings
Details

Impact

Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Database specific 
{
    "cwe_ids": [
        "CWE-119",
        "CWE-129"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-04-09T19:16:23Z",
    "github_reviewed_at": "2026-04-09T20:22:12Z"
}
References

Affected packages

crates.io / wasmtime

Package

Name
wasmtime
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.0.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jxhv-7h78-9775/GHSA-jxhv-7h78-9775.json"

crates.io / wasmtime

Package

Name
wasmtime
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime

Affected ranges

Type
SEMVER
Events
Introduced
25.0.0
Fixed
36.0.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jxhv-7h78-9775/GHSA-jxhv-7h78-9775.json"

crates.io / wasmtime

Package

Name
wasmtime
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime

Affected ranges

Type
SEMVER
Events
Introduced
37.0.0
Fixed
42.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jxhv-7h78-9775/GHSA-jxhv-7h78-9775.json"

crates.io / wasmtime

Package

Name
wasmtime
View open source insights on deps.dev
Purl
pkg:cargo/wasmtime

Affected ranges

Type
SEMVER
Events
Introduced
43.0.0
Fixed
43.0.1

Affected versions

43.*
43.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jxhv-7h78-9775/GHSA-jxhv-7h78-9775.json"