Vulnerability HighRUSTSEC-2022-0075 · wasmtime
RUSTSEC-2022-0075: Bug in pooling instance allocator
Short answerA security vulnerability in the wasmtime crate: Bug in pooling instance allocator. GitHub rates it High. Fixed in 1.0.2, 2.0.2: update to a fixed version.
| Crate | wasmtime |
|---|---|
| Type | Vulnerability (memory-exposure) |
| Affected versions | Before 1.0.2; from 2.0.0 before 2.0.2. |
| Fixed in | 1.0.2, 2.0.2 |
| Severity | High (GitHub rating) |
| Published | 2022-11-10 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2022-39393, GHSA-wh6w-3828-g9qf, RUSTSEC-2022-0098 |
What to do
- See which version you have:
cargo tree -i wasmtime(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p wasmtime. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplewasmtime = "2.0.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance.
Mitigations are described here.
References
- Package: crates.io/crates/wasmtime
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0075.html
- Web: github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
- Web: github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
- Web: github.com/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for wasmtime
- Vulnerability MediumRUSTSEC-2021-0110 · 2021-09-17Multiple Vulnerabilities in Wasmtime
- VulnerabilityRUSTSEC-2022-0016 · 2022-03-31Use after free with `externref`s and epoch interruption in Wasmtime
- Vulnerability HighRUSTSEC-2022-0076 · 2022-11-10Bug in Wasmtime implementation of pooling instance allocator
- VulnerabilityRUSTSEC-2022-0095 · 2022-06-27Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
- VulnerabilityRUSTSEC-2022-0096 · 2022-02-17Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
- Vulnerability LowRUSTSEC-2022-0097 · 2022-11-07Out of bounds write in `wasmtime_trap_code` C API function
- Vulnerability HighRUSTSEC-2022-0098 · 2022-11-05Data leakage between instances in the pooling allocator
- VulnerabilityRUSTSEC-2022-0099 · 2022-03-28 Use after free with `externref`s and epoch interruption in Wasmtime
Up next
Same cratewasmtime: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?