Vulnerability MediumRUSTSEC-2021-0110 · wasmtime
RUSTSEC-2021-0110: Multiple Vulnerabilities in Wasmtime
Short answerA security vulnerability in the wasmtime crate: Multiple Vulnerabilities in Wasmtime. Medium severity (CVSS 6.3). Fixed in 0.30.0: update to a fixed version.
| Crate | wasmtime |
|---|---|
| Type | Vulnerability (memory-corruption, memory-exposure) |
| Affected versions | Before 0.30.0. |
| Fixed in | 0.30.0 |
| Severity | Medium, CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
| Published | 2021-09-17 |
| Last changed | 2024-03-15 |
| Also known as | CVE-2021-39216, CVE-2021-39218, CVE-2021-39219, GHSA-4873-36h9-wv49, GHSA-q879-9g95-56mx, GHSA-v4cp-h94r-m7xf, PYSEC-2021-320, PYSEC-2021-321, PYSEC-2021-322 |
| Affected functions | wasmtime::Linker::func_new, wasmtime::Linker::func_wrap, wasmtime::Store::gc |
What to do
- See which version you have:
cargo tree -i wasmtime(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p wasmtime. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplewasmtime = "0.30.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
References
- Package: crates.io/crates/wasmtime
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0110.html
- Advisory: github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf
- Advisory: github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49
- Advisory: github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for wasmtime
- VulnerabilityRUSTSEC-2022-0016 · 2022-03-31Use after free with `externref`s and epoch interruption in Wasmtime
- VulnerabilityRUSTSEC-2022-0075 · 2022-11-10Bug in pooling instance allocator
- Vulnerability HighRUSTSEC-2022-0076 · 2022-11-10Bug in Wasmtime implementation of pooling instance allocator
- VulnerabilityRUSTSEC-2022-0095 · 2022-06-27Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
- VulnerabilityRUSTSEC-2022-0096 · 2022-02-17Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
- Vulnerability LowRUSTSEC-2022-0097 · 2022-11-07Out of bounds write in `wasmtime_trap_code` C API function
- Vulnerability HighRUSTSEC-2022-0098 · 2022-11-05Data leakage between instances in the pooling allocator
- VulnerabilityRUSTSEC-2022-0099 · 2022-03-28 Use after free with `externref`s and epoch interruption in Wasmtime
Up next
Same cratewasmtime: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?