CVE Tools
Track your stack

Wasmtime

81 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Wasmtime, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Wasmtime CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Wasmtime CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-102
2025-111
2025-120
2026-011
2026-023
2026-030
2026-0412
2026-051
2026-061
2026-072
2026-080
2026-090
2026-1034
2026-113

Severity

How the 81 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical68%
  • High1418%
  • Medium4253%
  • Low1722%

Latest CVEs

The 15 most recently published vulnerabilities affecting Wasmtime.

  1. CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling3.7
  2. CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass3.7
  3. CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http5.3
  4. CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes4.8
  5. CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop4.8
  6. CVE-2026-119141Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc5.3
  7. CVE-2026-119139Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call4.8
  8. CVE-2026-119140Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield4.8
  9. CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap4.8
  10. CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry5.3
  11. CVE-2026-119136Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass4.8
  12. CVE-2026-119134Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles6.2
  13. CVE-2026-119135Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch4.8
  14. CVE-2026-119133Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags2.6
  15. CVE-2026-119132Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter4.8

Product grouping is registry-driven, with AI assist and human review. How it works