Vulnerability HighRUSTSEC-2022-0016 · wasmtime
RUSTSEC-2022-0016: Use after free with `externref`s and epoch interruption in Wasmtime
Short answerA security vulnerability in the wasmtime crate: Use after free with `externref`s and epoch interruption in Wasmtime. GitHub rates it High. Fixed in 0.34.2, 0.35.2: update to a fixed version.
| Crate | wasmtime |
|---|---|
| Type | Vulnerability (memory-corruption, memory-exposure) |
| Affected versions | From 0.34.0 before 0.34.2; from 0.35.0 before 0.35.2. |
| Fixed in | 0.34.2, 0.35.2 |
| Severity | High (GitHub rating) |
| Published | 2022-03-31 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2022-24791, GHSA-gwc9-348x-qwv2, RUSTSEC-2022-0099 |
| Affected functions | wasmtime::Config::epoch_interruption |
What to do
- See which version you have:
cargo tree -i wasmtime(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p wasmtime. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplewasmtime = "0.35.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Use after free with externrefs and epoch interruption in Wasmtime
References
- Package: crates.io/crates/wasmtime
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0016.html
- Web: github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for wasmtime
- Vulnerability MediumRUSTSEC-2021-0110 · 2021-09-17Multiple Vulnerabilities in Wasmtime
- VulnerabilityRUSTSEC-2022-0075 · 2022-11-10Bug in pooling instance allocator
- Vulnerability HighRUSTSEC-2022-0076 · 2022-11-10Bug in Wasmtime implementation of pooling instance allocator
- VulnerabilityRUSTSEC-2022-0095 · 2022-06-27Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
- VulnerabilityRUSTSEC-2022-0096 · 2022-02-17Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
- Vulnerability LowRUSTSEC-2022-0097 · 2022-11-07Out of bounds write in `wasmtime_trap_code` C API function
- Vulnerability HighRUSTSEC-2022-0098 · 2022-11-05Data leakage between instances in the pooling allocator
- VulnerabilityRUSTSEC-2022-0099 · 2022-03-28 Use after free with `externref`s and epoch interruption in Wasmtime
Up next
Same cratewasmtime: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?