bytecodealliance wasmtime vulnerabilities

CVEs per yearBy the year they were published

1. 20214
2. 20228
3. 20234
4. 20244
5. 20254
6. 202657

Newest CVEs

• CVE-2026-121441

  Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

  bytecodealliance · wasmtime

  Medium6.3
• CVE-2026-121440

  Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

  bytecodealliance · wasmtime

  Medium6.3
• CVE-2026-121439

  Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

  bytecodealliance · wasmtime

  Medium6.9
• CVE-2026-119143

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119142

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119141

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

  bytecodealliance · wasmtime

  Medium6.9
• CVE-2026-119140

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119139

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119138

  Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap

  bytecodealliance · wasmtime

  Medium5.9
• CVE-2026-119137

  Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

  bytecodealliance · wasmtime

  Medium6.9