libwasmtime -- Multiple vulnerabilities

2026-10-30 · VuXML entry

Wasmtime development team reports: wasi-sockets: UDP connect only required the address to be permitted for sending or receiving, allowing guests to send datagrams to addresses denied for UdpSend. Cross-engine type confusion with host-created struct-types-with-supertypes has been fixed. Panic with typed functions with i31 or nullref arguments has been fixed. Unchecked memory usage in transferring borrowed resources …

Affected versions

• libwasmtime, wasmtime < 36.0.20; >= 37.0.0 < 48.0.8; >= 49.0.0 < 49.0.5; >= 50.0.0 < 50.0.1
• codemark <= 0.7.30_2
• gram-text-editor <= 3.3.0_1
• lapce <= 0.4.6_8
• mongodb90, mongodb90-armv80a <= 9.0.4
• moon <= 2.6.3
• surfer <= 0.7.0_4
• surrealdb <= 3.3.5
• tree-sitter-cli <= 0.26.13_2
• veloren-weekly <= s20261027
• veryl <= 0.22.0_1
• vscode <= 1.143.1_1
• waveterm <= 0.14.5_32
• wizer <= 11.0.3_5
• zed-editor <= 1.25.3
• zeroclaw <= 0.8.0.b.2_3

By system

15 still vulnerable, 10 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.