Skip to content

Commit d909b02

Browse files
alexcrichtondjc
authored andcommitted
Add advisories just published for Wasmtime
* GHSA-243v-98vx-264h * GHSA-xjhv-v822-pf94 * GHSA-852m-cvvp-9p4w
1 parent f373f46 commit d909b02

File tree

3 files changed

+82
-0
lines changed

3 files changed

+82
-0
lines changed
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2026-02-24"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2026-27572", "GHSA-243v-98vx-264h"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
12+
13+
[versions]
14+
patched = [
15+
">= 24.0.6, < 25.0.0",
16+
">= 36.0.6, < 37.0.0",
17+
">= 40.0.4, < 41.0.0",
18+
">= 41.0.4",
19+
]
20+
unaffected = []
21+
```
22+
23+
# Panic adding excessive fields to a `wasi:http/types.fields` instance
24+
25+
This is an entry in the RustSec database for the Wasmtime security advisory
26+
located at
27+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h
28+
For more information see the GitHub-hosted security advisory.
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2026-02-24"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2026-27195", "GHSA-xjhv-v822-pf94"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
12+
13+
[versions]
14+
patched = [
15+
">= 40.0.4, < 41.0.0",
16+
">= 41.0.4",
17+
]
18+
unaffected = ["< 39.0.0"]
19+
```
20+
21+
# Panic when dropping a `[Typed]Func::call_async` future
22+
23+
This is an entry in the RustSec database for the Wasmtime security advisory
24+
located at
25+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94
26+
For more information see the GitHub-hosted security advisory.
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2026-02-24"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-852m-cvvp-9p4w"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2026-27204", "GHSA-852m-cvvp-9p4w"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
12+
13+
[versions]
14+
patched = [
15+
">= 24.0.6, < 25.0.0",
16+
">= 36.0.6, < 37.0.0",
17+
">= 40.0.4, < 41.0.0",
18+
">= 41.0.4",
19+
]
20+
unaffected = []
21+
```
22+
23+
# Guest-controlled resource exhaustion in WASI implementations
24+
25+
This is an entry in the RustSec database for the Wasmtime security advisory
26+
located at
27+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-852m-cvvp-9p4w
28+
For more information see the GitHub-hosted security advisory.

0 commit comments

Comments
 (0)