JLSEC-2026-1355

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1355.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1355.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-1355
Upstream
  • EUVD-2026-20990
Published
2026-08-21T20:43:33.133Z
Modified
2026-08-21T21:14:22.065104343Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Wasmtime: Panic when transcoding misaligned utf-16 strings
Details

Impact

Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Database specific 
{
    "sources": [
        {
            "imported": "2026-08-21T20:09:02.076Z",
            "published": "2026-04-09T19:16:23.857Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34942",
            "id": "CVE-2026-34942",
            "database_specific": {
                "status": "Analyzed"
            },
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34942",
            "affected": {
                "bytecodealliance:wasmtime": [
                    "< 24.0.7",
                    ">= 25.0.0, < 36.0.7",
                    ">= 37.0.0, < 42.0.2",
                    ">= 43.0.0, < 43.0.1"
                ]
            },
            "modified": "2026-06-17T10:39:51.497Z"
        },
        {
            "imported": "2026-08-21T20:09:13.967Z",
            "published": "2026-04-09T20:22:12Z",
            "url": "https://api.github.com/advisories/GHSA-jxhv-7h78-9775",
            "html_url": "https://github.com/advisories/GHSA-jxhv-7h78-9775",
            "id": "GHSA-jxhv-7h78-9775",
            "modified": "2026-04-24T21:03:48Z"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20990",
            "affected": {
                "bytecodealliance:wasmtime": [
                    "25.0.0, < 36.0.7",
                    "37.0.0, < 42.0.2",
                    "43.0.0, < 44.0.1",
                    "< 24.0.7"
                ]
            },
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-20990",
            "published": "2026-04-09T18:32:56Z",
            "imported": "2026-08-21T20:09:03.523Z",
            "id": "EUVD-2026-20990",
            "modified": "2026-04-09T19:36:13Z"
        }
    ],
    "license": "CC-BY-4.0"
}
References
Credits

Affected packages

Julia / Wasmtime_jll

Package

Name
Wasmtime_jll
Purl
pkg:julia/Wasmtime_jll?uuid=d20e7296-4f3e-515c-90b9-d2595a77bf72

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.0.1+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1355.json"