[Git][security-tracker-team/security-tracker][master] Update status for some rust-wasmtime issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 29 21:00:29 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
5e0b8ca6 by Salvatore Bonaccorso at 2026-10-29T22:00:04+01:00
Update status for some rust-wasmtime issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -331,26 +331,21 @@ CVE-2026-119144 (Frappe Framework before 15.111.0 and 16.x before 16.21.0 contai
CVE-2026-119140 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
- rust-wasmtime <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g
-CVE-2026-119139 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a left ...)
- TODO: check
CVE-2026-119138 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
- TODO: check
-CVE-2026-119137 (Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stac ...)
- TODO: check
+ - rust-wasmtime <not-affected> (Vulnerable code introduced later)
+ NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5
CVE-2026-119136 (Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insuff ...)
- TODO: check
-CVE-2026-119135 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the ...)
- TODO: check
-CVE-2026-119134 (Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0. ...)
- TODO: check
+ - rust-wasmtime <not-affected> (Vulnerable code introduced later)
+ NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379
CVE-2026-119133 (Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memo ...)
- TODO: check
-CVE-2026-119132 (Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulner ...)
- TODO: check
+ - rust-wasmtime <not-affected> (Vulnerable code introduced later)
+ NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp
CVE-2026-119131 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
- TODO: check
+ - rust-wasmtime <not-affected> (Vulnerable code introduced later)
+ NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9
CVE-2026-119130 (Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0. ...)
- TODO: check
+ - rust-wasmtime <unfixed>
+ NOTE: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx
CVE-2026-119129 (ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missin ...)
TODO: check
CVE-2026-119128 (ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerab ...)
@@ -8303,7 +8298,7 @@ CVE-2025-30045 (CGM CLININET is vulnerable to Code Injection in the ConvExpr fun
NOT-FOR-US: CGM CLININET
CVE-2025-30043 (CGM CLININET is vulnerable to Missing Authentication for Critical Func ...)
NOT-FOR-US: CGM CLININET
-CVE-2026-XXXX [RUSTSEC-2026-0353]
+CVE-2026-119139 [RUSTSEC-2026-0353]
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0353.html
NOTE: https://github.com/advisories/GHSA-m6w2-jwq2-cv2c
@@ -8313,7 +8308,7 @@ CVE-2026-119142 [RUSTSEC-2026-0354]
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0354.html
NOTE: https://github.com/advisories/GHSA-3r89-v5mq-j5xf
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14741
-CVE-2026-XXXX [RUSTSEC-2026-0355]
+CVE-2026-119135 [RUSTSEC-2026-0355]
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0355.html
NOTE: https://github.com/advisories/GHSA-63h4-6cx9-pjfj
@@ -8328,17 +8323,17 @@ CVE-2026-119143 [RUSTSEC-2026-0357]
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0357.html
NOTE: https://github.com/advisories/GHSA-93g3-36p8-x2gc
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14740
-CVE-2026-XXXX [RUSTSEC-2026-0359]
+CVE-2026-119137 [RUSTSEC-2026-0359]
- rust-wasmtime <not-affected> (Only affects 42 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0359.html
NOTE: https://github.com/advisories/GHSA-wjc8-633q-pwxr
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14735
-CVE-2026-XXXX [RUSTSEC-2026-0360]
+CVE-2026-119132 [RUSTSEC-2026-0360]
- rust-wasmtime <not-affected> (Only affects 49 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0360.html
NOTE: https://github.com/advisories/GHSA-54p9-vhhq-8f7q
NOTE: https://github.com/bytecodealliance/wasmtime/pull/14730
-CVE-2026-XXXX [RUSTSEC-2026-0363]
+CVE-2026-119134 [RUSTSEC-2026-0363]
- rust-wasmtime <unfixed> (bug #1151861)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0363.html
NOTE: https://github.com/advisories/GHSA-q554-3cjc-rx7p
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e0b8ca6b11e95c2070d5171f674db3864059557
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e0b8ca6b11e95c2070d5171f674db3864059557
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/57729552/attachment.htm>
More information about the debian-security-tracker-commits
mailing list