[Git][security-tracker-team/security-tracker][master] new wasmtime issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6e1ae6e6 by Moritz Muehlenhoff at 2026-10-23T15:37:41+02:00
new wasmtime issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -352,35 +352,49 @@ CVE-2026-115395 (Ghidra 10.3 before 12.2 contains a resource allocation without
 CVE-2026-115394 (Ghidra through 12.2 contains an uncontrolled memory allocation vulnera ...)
 	- ghidra <itp> (bug #923851)
 CVE-2026-115393 (Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2,  ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9
 CVE-2026-115392 (Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3,  ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg
 CVE-2026-115391 (Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an unc ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 46 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759
 CVE-2026-115390 (Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 47 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x
 CVE-2026-115389 (Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0. ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr
 CVE-2026-115388 (wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, a ...)
-	TODO: check
+	NOT-FOR-US: Rust wasmtime wasi-http
 CVE-2026-115387 (Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0. ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h
 CVE-2026-115386 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0. ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24
 CVE-2026-115385 (Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a deni ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 46 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc
 CVE-2026-115384 (Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stac ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 39 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c
 CVE-2026-115383 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an imp ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 47 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj
 CVE-2026-115382 (Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a deni ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 46 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
 CVE-2026-115381 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0. ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
 CVE-2026-115380 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0. ...)
-	TODO: check
+	- rust-wasmtime <unfixed>
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm
 CVE-2026-115379 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a miss ...)
-	TODO: check
+	- rust-wasmtime <not-affected> (Only affects 47 and later)
+	NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf
 CVE-2026-115369 (OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ ...)
 	- openbao <itp> (bug #1069794)
 CVE-2026-115366 (OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vul ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e1ae6e6081aa1a98703eba927b8a79437f40cf5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e1ae6e6081aa1a98703eba927b8a79437f40cf5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/5c9fe77b/attachment.htm>