DEBIAN-CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

CVE-2026-34988

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This...

CVE-2026-34987

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch baseline non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch...

CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

DEBIAN-CVE-2026-34944

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can resul...

DEBIAN-CVE-2026-34943

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits...

DEBIAN-CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

DEBIAN-CVE-2026-34946

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture...

DEBIAN-CVE-2026-34983

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following...

yowasp-nextpnr-ecp5 (>=0.0.0.post2625.dev9, <=0.0.0.post2639.dev13), yowasp-nextpnr-ecp5-25k (>=0.0.0.post2625.dev9, <=0.0.0.post2639.dev13) +11 more potentially affected by CVE-2026-34983 via wasmtime (0.18.2)

wasmtime PYPI version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - yowasp-nextpnr-ecp5 =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9,...

nmigen-yosys (0.9.0.post3527.dev26), yowasp-nextpnr-ecp5 (>=0.0.0.post2658.dev17, <=0.0.0.post2703.dev37) +12 more potentially affected by CVE-2026-34983 via wasmtime (0.19.0)

wasmtime PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - nmigen-yosys 0.9.0.post3527.dev26 - yowasp-nextpnr-ecp5 =0.0.0.post2658.dev17, =0.0.0.post2658.dev17, =0.0.0.post2658.dev17,...

nmigen-yosys (0.9.0.post3527.dev27), yowasp-nextpnr-ecp5 (0.0.0.post2706.dev40) +12 more potentially affected by CVE-2026-34983 via wasmtime (0.20.0)

wasmtime PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - nmigen-yosys 0.9.0.post3527.dev27 - yowasp-nextpnr-ecp5 0.0.0.post2706.dev40 - yowasp-nextpnr-ecp5-25k 0.0.0.post2706.dev40 -...

nmigen-yosys (>=0.9.0.post3527.dev29, <=0.9.0.post3746.dev31), yowasp-nextpnr-ecp5 (>=0.0.0.post2706.dev41, <=0.0.0.post3609.dev156) +12 more potentially affected by CVE-2026-34983 via wasmtime (0.21.0)

wasmtime PYPI version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - nmigen-yosys =0.9.0.post3527.dev29, =0.0.0.post2706.dev41, =0.0.0.post2706.dev41, =0.0.0.post2706.dev41, =0.0.0.post2706.dev41,...

memquery (0.1.1) potentially affected by CVE-2026-34983 via wasmtime (0.25.0)

wasmtime PYPI version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - memquery 0.1.1 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

nmigen-yosys (0.9.0.post3746.dev32), yowasp-nextpnr-ecp5 (>=0.0.0.post3645.dev165, <=0.0.0.post3645.dev167) +13 more potentially affected by CVE-2026-34983 via wasmtime (0.27.0)

wasmtime PYPI version 0.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - nmigen-yosys 0.9.0.post3746.dev32 - yowasp-nextpnr-ecp5 =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165,...

yowasp-nextpnr-ecp5 (>=0.0.0.post3694.dev181, <=0.0.0.post3816.dev218), yowasp-nextpnr-ecp5-25k (>=0.0.0.post3694.dev181, <=0.0.0.post3816.dev218) +13 more potentially affected by CVE-2026-34983 via wasmtime (0.28.1)

wasmtime PYPI version 0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - yowasp-nextpnr-ecp5 =0.0.0.post3694.dev181, =0.0.0.post3694.dev181, =0.0.0.post3694.dev181, =0.0.0.post3694.dev181, =0.0.0.post3694.dev181,...

amaranth-yosys (0.9.0.post3746.dev41), nmigen-yosys (>=0.9.0.post3746.dev34, <=0.9.0.post3746.dev38) +15 more potentially affected by CVE-2026-34983 via wasmtime (0.30.0)

wasmtime PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.9.0.post3746.dev41 - nmigen-yosys =0.9.0.post3746.dev34, =0.0.0.post3849.dev224, =0.0.0.post3849.dev224, =0.0.0.post3849.dev22...

amaranth-yosys (0.10.0.dev44) potentially affected by CVE-2026-34983 via wasmtime (0.31.0)

wasmtime PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.10.0.dev44 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.10.0.dev46) potentially affected by CVE-2026-34983 via wasmtime (0.32.0)

wasmtime PYPI version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.10.0.dev46 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...