Vulnerability RUSTSEC-2022-0075

Unknown

3 years ago

Bug in pooling instance allocator

0.0.0 - 1.0.1

Summary

Bug in pooling instance allocator

Details

bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance.

Mitigations are described here.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Low Risk

9 days ago

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

46.0.0 - 46.0.1 and 47.0.0 - 47.0.2 GHSA-2hw9-mc66-jc2q

Unknown

10 days ago

Mis-typed WebAssembly tag imports can lead to GC heap corruption

47.0.0 - 48.0.3 RUSTSEC-2026-0325

Medium Risk

10 days ago

Rooting for GC values live across `try_call` may be missing, causing GC heap corruption

47.0.0 - 48.0.3 RUSTSEC-2026-0326

Unknown

10 days ago

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

39.0.0 - 48.0.3 RUSTSEC-2026-0327

Medium Risk

18 days ago

`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification

47.0.0 - 48.0.2 RUSTSEC-2026-0315

View all vulnerabilities for these packages

Impacted packages

wasmtime

Timeline

Published

3 years ago

Fixed (2.0.2)

3 years ago

Fixed (1.0.2)

3 years ago

Last Modified

1 hour ago