libwasmtime -- Multiple vulnerabilities

2026-10-21 · VuXML entry

Wasmtime development team reports: Out-of-bounds zero-length stream writes can panic. Host panic when component call_async is cancelled under some conditions. Panic on erroneous call-to-host from guest realloc call. Yielding in a component start function can lead to a host panic. Panic when invoking an async-lifted function via call. Panic when pending calls are run after a trap. Stack overflow dropping a long chain …

Affected versions

• libwasmtime, wasmtime < 36.0.19; >= 37.0.0 < 48.0.7; >= 49.0.0 < 49.0.4
• codemark <= 0.7.30_2
• gram-text-editor <= 3.3.0_1
• lapce <= 0.4.6_8
• mongodb90, mongodb90-armv80a <= 9.0.4
• moon <= 2.6.3
• surfer <= 0.7.0_4
• surrealdb <= 3.2.6
• tree-sitter-cli <= 0.26.13_2
• veloren-weekly < s20261027
• veryl <= 0.22.0_1
• vscode <= 1.143.1
• waveterm <= 0.14.5_32
• wizer <= 11.0.3_5
• zed-editor < 1.25.3
• zeroclaw <= 0.8.0.b.2_3

By system

14 still vulnerable, 11 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.