RUSTSEC-2024-0442: Dump Undefined Memory by `JitDumpFile`

What to do

1. See which version you have: cargo tree -i wasmtime-jit-debug (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p wasmtime-jit-debug. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example wasmtime-jit-debug = "24.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The unsound function dump_code_load_record uses from_raw_parts to directly convert the pointer addr and len into a slice without any validation and that memory block would be dumped.

Thus, the 'safe' function dump_code_load_record is actually 'unsafe' since it requires the caller to guarantee that the addr is valid and len must not overflow. Otherwise, the function could dump the memory into file illegally, causing memory leak.

> **Note**: this is an internal-only crate in the Wasmtime project not intended for external use and is more strongly signaled nowadays as of bytecodealliance/wasmtime#10963. Please open an issue in Wasmtime if you're using this crate directly.

References

• Package: crates.io/crates/wasmtime-jit-debug
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0442.html
• Report: github.com/bytecodealliance/wasmtime/issues/8905

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.