RUSTSEC-2026-0354 Host panic when component `call_async` is cancelled under some conditions

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory...

JLSEC-2026-1351 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

The affected versions of Wasmtime can panic if the host embedder drops the future returned by wasmtime::component::TypedFunc::callasync before it resolves. Details Starting with Wasmtime 39.0.0, the component-model-async feature became the default, which brought with it a new implementation of...

wasmtime:call_async: Crash in <wasmtime::runtime::instance::Instance>::start_raw::<wasmtime_fuzzing::oracles::

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=6125949392584704 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: callasync Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7624b92af0...

CVE-2026-27195

Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the component-model-async feature became the default, which brought with it a new implementation of TypedFunc::callasync which made it capable of calling async-typed guest export functions. However, that implementation had a bu...

CVE-2026-27195

Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the "component-model-async" feature became the default, which brought with it a new implementation of "TypedFunc::callasync" which made it capable of calling async-typed guest export functions. However, that implementation had ...

CVE-2026-27195 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the component-model-async feature became the default, which brought with it a new implementation of TypedFunc::callasync which made it capable of calling async-typed guest export functions. However, that implementation had a bu...

WasmTime security vulnerability

Wasmtime is a lightweight WebAssembly runtime open source by the Bytecode Alliance. There is a security vulnerability in Wastime, which stems from a defect in the implementation of TypedFunc::callasync when the component-model-async feature is enabled by default. This could lead to a kernel crash...

CVE-2026-27195: Improper Handling of Exceptional Conditions

Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the component-model-async feature became the default, which brought with it a new implementation of TypedFunc::callasync which made it capable of calling async-typed guest export functions. However, that implementation had a bu...

wasmtime:call_async: Crash in call_async

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4919912355397632 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: callasync Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000202020...

wasmtime:call_async: Segv on unknown address in module.wasm

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4874192684384256 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: callasync Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Segv on unknown address Crash Address:...

wasmtime:call_async: Null-dereference READ in wasmtime::runtime::vm::sys::unix::signals::trap_handler::ha6c97a5308add0e4

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4575298041741312 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: callasync Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Null-dereference READ Crash Address:...