Vulnerability RUSTSEC-2026-0420
Medium Risk
MEDIUM RISK
CVSS Score: 6.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 day ago
October 29, 2026 at 12:00 PM UTC
wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving
48.0.0 - 48.0.7 and 49.0.0 - 49.0.4 and 50.0.0
48.0.0 - 48.0.7 and 49.0.0 - 49.0.4 and 50.0.0
Summary
wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving
Details
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j For more information see the GitHub-hosted security advisory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
14 days ago
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
0.2.0 - 24.0.10 and 25.0.0 - 36.0.11 and 37.0.0 - 45.0.2 and 46.0.0 GHSA-4ch3-9j33-3pmj
0.2.0 - 24.0.10 and 25.0.0 - 36.0.11 and 37.0.0 - 45.0.2 and 46.0.0 GHSA-4ch3-9j33-3pmj
Unknown
16 days ago
Filesystem sandbox escape when renaming symlinks with trailing slashes
0.2.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0352
0.2.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0352
Medium Risk
28 days ago
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
0.2.0 - 36.0.16 and 37.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0321
0.2.0 - 36.0.16 and 37.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0321
Unknown
28 days ago
Excessive allocated memory on the host when guests don't have stdio
0.2.0 - 36.0.16 and 37.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0322
0.2.0 - 36.0.16 and 37.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0322
Unknown
28 days ago
fd_readdir copies uninitialized struct padding into guest memory
0.2.0 - 36.0.16 and 37.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0323
0.2.0 - 36.0.16 and 37.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0323
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 12:00 PM UTC
Fixed (50.0.1)
1 day ago
October 29, 2026 at 05:49 PM UTC
Fixed (49.0.5)
1 day ago
October 29, 2026 at 06:12 PM UTC
Fixed (48.0.8)
1 day ago
October 29, 2026 at 06:34 PM UTC
Last Modified
17 hours ago
October 30, 2026 at 10:45 AM UTC