JLSEC-2026-1358

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1358.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1358.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-1358
Upstream
  • EUVD-2026-21024
Published
2026-08-21T20:43:33.133Z
Modified
2026-08-21T21:14:21.990857996Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Wasmtime has host data leakage with 64-bit tables and Winch
Details

Impact

Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests.

This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This information disclosure should not be possible in WebAssembly, violates spec semantics, and is a vulnerability in Wasmtime.

Patches

Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

Users of Cranelift are not affected by this issue, but users of Winch have no workarounds other than disabling the Config::wasm_memory64 proposal.

Database specific 
{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "id": "CVE-2026-34945",
            "published": "2026-04-09T19:16:24.330Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34945",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34945",
            "modified": "2026-06-17T10:39:51.837Z",
            "affected": {
                "bytecodealliance:wasmtime": [
                    ">= 25.0.0, < 36.0.7",
                    ">= 37.0.0, < 42.0.2",
                    ">= 43.0.0, < 43.0.1"
                ]
            },
            "imported": "2026-08-21T20:09:02.077Z",
            "database_specific": {
                "status": "Analyzed"
            }
        },
        {
            "id": "GHSA-m9w2-8782-2946",
            "published": "2026-04-09T20:23:02Z",
            "url": "https://api.github.com/advisories/GHSA-m9w2-8782-2946",
            "html_url": "https://github.com/advisories/GHSA-m9w2-8782-2946",
            "modified": "2026-04-24T21:03:34Z",
            "imported": "2026-08-21T20:09:07.150Z"
        },
        {
            "id": "EUVD-2026-21024",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21024",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-21024",
            "published": "2026-04-09T18:40:48Z",
            "modified": "2026-04-10T14:12:18Z",
            "affected": {
                "bytecodealliance:wasmtime": [
                    "25.0.0, < 36.0.7",
                    "37.0.0, < 42.0.2",
                    "43.0.0, < 44.0.1"
                ]
            },
            "imported": "2026-08-21T20:09:03.523Z"
        }
    ]
}
References
Credits

Affected packages

Julia / Wasmtime_jll

Package

Name
Wasmtime_jll
Purl
pkg:julia/Wasmtime_jll?uuid=d20e7296-4f3e-515c-90b9-d2595a77bf72

Affected ranges

Type
SEMVER
Events
Introduced
39.0.0+0
Fixed
45.0.1+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1358.json"