[Git][security-tracker-team/security-tracker][master] rust-wasmtime issues CVEfied
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 23 19:03:47 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
53f72084 by Moritz Muehlenhoff at 2026-10-23T19:59:41+02:00
rust-wasmtime issues CVEfied
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1275,20 +1275,27 @@ CVE-2026-115395 (Ghidra 10.3 before 12.2 contains a resource allocation without
CVE-2026-115394 (Ghidra through 12.2 contains an uncontrolled memory allocation vulnera ...)
- ghidra <itp> (bug #923851)
CVE-2026-115393 (Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, ...)
- - rust-wasmtime <unfixed>
+ - rust-wasmtime 36.0.13+dfsg-1
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0222.html
CVE-2026-115392 (Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, ...)
- rust-wasmtime <unfixed>
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0269.html
CVE-2026-115391 (Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an unc ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0268.html
CVE-2026-115390 (Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel ...)
- rust-wasmtime <not-affected> (Only affects 47 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0315.html
+ NOTE: https://github.com/bytecodealliance/wasmtime/pull/14407
CVE-2026-115389 (Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0. ...)
- rust-wasmtime <unfixed>
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0316.html
+ NOTE: https://github.com/bytecodealliance/wasmtime/pull/14415
CVE-2026-115388 (wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, a ...)
NOT-FOR-US: Rust wasmtime wasi-http
CVE-2026-115387 (Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0. ...)
@@ -1303,9 +1310,11 @@ CVE-2026-115385 (Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains
CVE-2026-115384 (Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stac ...)
- rust-wasmtime <not-affected> (Only affects 39 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0327.html
CVE-2026-115383 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an imp ...)
- rust-wasmtime <not-affected> (Only affects 47 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0325.html
CVE-2026-115382 (Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a deni ...)
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv
@@ -1318,6 +1327,7 @@ CVE-2026-115380 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 befor
CVE-2026-115379 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a miss ...)
- rust-wasmtime <not-affected> (Only affects 47 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0326.html
CVE-2026-115369 (OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ ...)
- openbao <itp> (bug #1069794)
CVE-2026-115366 (OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vul ...)
@@ -32441,8 +32451,9 @@ CVE-2026-104861 (probe-image-size gets image dimensions without downloading the
CVE-2026-104859 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
NOT-FOR-US: Nx
CVE-2026-104855 (Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47 ...)
- - rust-wasmtime <not-affected> (Vulnerable code not present)
+ - rust-wasmtime <not-affected> (Only affects 46.0.0 and later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0223.html
CVE-2026-104854 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
NOT-FOR-US: Nx
CVE-2026-104853 (Nx is a monorepo solution for TypeScript and polyglot codebases. From ...)
@@ -33722,14 +33733,6 @@ CVE-2026-102504 (Imager versions before 1.037 for Perl exit the process reading
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43998314/
NOTE: https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6
NOTE: Fixed by: https://github.com/tonycoz/imager/commit/21b0df9eef1dffe1fdcd3706bfea9f1338031679 (v1.037)
-CVE-2026-XXXX [RUSTSEC-2026-0316]
- - rust-wasmtime <unfixed>
- NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0316.html
- NOTE: https://github.com/bytecodealliance/wasmtime/pull/14415
-CVE-2026-XXXX [RUSTSEC-2026-0315]
- - rust-wasmtime <not-affected> (Introduced in 47.0.0)
- NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0315.html
- NOTE: https://github.com/bytecodealliance/wasmtime/pull/14407
CVE-2026-96561 (The AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress plu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96255 (The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent ...)
@@ -73402,14 +73405,6 @@ CVE-2026-11613 (The Divi Ajax Filter plugin for WordPress is vulnerable to Local
NOT-FOR-US: WordPress plugin
CVE-2025-15691 (The WPFunnels WordPress plugin before 3.13.0 does not check whether u ...)
NOT-FOR-US: WordPress plugin
-CVE-2026-XXXX [RUSTSEC-2026-0269]
- - rust-wasmtime <unfixed>
- NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg
- NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0269.html
-CVE-2026-XXXX [RUSTSEC-2026-0268]
- - rust-wasmtime <not-affected> (Introduced in 0.46)
- NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759
- NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0268.html
CVE-2026-84732 (Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 a ...)
- openvpn 2.7.7-1
NOTE: https://community.openvpn.net/Security%20Announcements/CVE-2026-84732
@@ -99996,12 +99991,6 @@ CVE-2026-102342 (ammonia is a Rust library for repairing and securing untrusted
NOTE: https://github.com/rust-ammonia/ammonia/pull/251
NOTE: https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6 (v4.1.4)
NOTE: https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d (v4.0.3)
-CVE-2026-XXXX [RUSTSEC-2026-0223]
- - rust-wasmtime <not-affected> (Only affects 46.0.0 and later)
- NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0223.html
-CVE-2026-XXXX [RUSTSEC-2026-0222]
- - rust-wasmtime 36.0.13+dfsg-1
- NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0222.html
CVE-2026-XXXX [RUSTSEC-2026-0244]
- rust-gettext-rs <unfixed> (bug #1144394)
[trixie] - rust-gettext-rs <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/53f720842ef2dee97fefc4f6b369f891bf1bde83
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/53f720842ef2dee97fefc4f6b369f891bf1bde83
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/878a3fb2/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list