bytecodealliance vulnerabilities

CVEs per yearBy the year they were published

1. 20215
2. 20228
3. 20234
4. 20246
5. 20259
6. 202660

Newest CVEs

• CVE-2026-54912

  WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

  bytecodealliance · wasm-micro-runtime

  High8.8
• CVE-2026-54913

  WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

  bytecodealliance · wasm-micro-runtime

  Medium6.9
• CVE-2026-54914

  WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

  bytecodealliance · wasm-micro-runtime

  High8.3
• CVE-2026-121441

  Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

  bytecodealliance · wasmtime

  Medium6.3
• CVE-2026-121440

  Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

  bytecodealliance · wasmtime

  Medium6.3
• CVE-2026-121439

  Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

  bytecodealliance · wasmtime

  Medium6.9
• CVE-2026-119143

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119142

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119141

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

  bytecodealliance · wasmtime

  Medium6.9
• CVE-2026-119140

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield

  bytecodealliance · wasmtime

  Medium5.9