Vulnerability GHSA-243v-98vx-264h: Information
Description
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
Severity: (6.9)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| wasmtime | sisyphus | 43.0.0-alt1 | 43.0.0-alt1 | ALT-PU-2026-5689-2 | 414049 | Fixed |
| wasmtime | sisyphus_riscv64 | 43.0.0-alt1 | 43.0.0-alt1 | ALT-PU-2026-7613-1 | - | Fixed |
| wasmtime | sisyphus_loongarch64 | 43.0.0-alt1 | 43.0.0-alt1 | ALT-PU-2026-7551-1 | - | Fixed |
Affected packages
Ecosystem | Name | Affected versions | Patched versions |
|---|---|---|---|
| crates.io | wasmtime | <24.0.6 >=25.0.0, <36.0.6 >=37.0.0, <40.0.4 | 24.0.6 36.0.6 40.0.4 |