Packages / Debian 13 (Trixie) / Source / rust / rust-wasmtime

Source Package: rust-wasmtime (0.113.1+26.0.1+dfsg-3)

low-level retargetable code generator - Rust source code

The following binary packages are built from this source package:

librust-cranelift-dev
low-level retargetable code generator - Rust source code

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-115893] Published: Oct 23, 2026, 10:16:58 PM UTC UBUNTU-CVE-2026-115893	Unknown	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115889] Published: Oct 23, 2026, 10:16:58 PM UTC DEBIAN-CVE-2026-115889	Unknown(9.9)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115392] Published: Oct 22, 2026, 7:17:46 PM UTC UBUNTU-CVE-2026-115392	Unknown	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115387] Published: Oct 22, 2026, 7:17:46 PM UTC UBUNTU-CVE-2026-115387	Unknown	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115381] Published: Oct 22, 2026, 7:17:45 PM UTC DEBIAN-CVE-2026-115381	Unknown(5.9)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115380] Published: Oct 22, 2026, 7:17:44 PM UTC DEBIAN-CVE-2026-115380	Unknown(5.1)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115393] Published: Oct 22, 2026, 7:13:59 PM UTC UBUNTU-CVE-2026-115393	Unknown(3.8)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115389] Published: Oct 22, 2026, 7:13:55 PM UTC UBUNTU-CVE-2026-115389	Unknown(2.5)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-115386] Published: Oct 22, 2026, 7:13:52 PM UTC UBUNTU-CVE-2026-115386	Unknown(3.3)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-58494] Published: Jul 8, 2026, 8:22:16 PM UTC DEBIAN-CVE-2026-58494	Unknown(6.5)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected pypi · rust-wasmtime · debian · 13
[CVE-2026-54786] Published: Jul 1, 2026, 8:12:35 PM UTC Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain	Medium(5)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-47261] Published: Jun 15, 2026, 7:47:40 PM UTC Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access co	High(7.5)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-44216] Published: May 14, 2026, 2:54:32 PM UTC Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This over	High(7.5)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-35195] Published: Apr 9, 2026, 6:55:56 PM UTC Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest	Medium(6.3)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-35186] Published: Apr 9, 2026, 6:54:48 PM UTC Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to	Medium(6.9)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-34988] Published: Apr 9, 2026, 6:52:26 PM UTC Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents	Medium(6.3)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-34987] Published: Apr 9, 2026, 6:48:33 PM UTC Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to ac	Critical(9)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-34983] Published: Apr 9, 2026, 6:47:26 PM UTC Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be trigg	Low(2.5)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-34971] Published: Apr 9, 2026, 6:45:44 PM UTC Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap acce	Critical(9)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13
[CVE-2026-34946] Published: Apr 9, 2026, 6:43:39 PM UTC Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can resu	Medium(5.9)	Affected Details (2) `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13 `0.113.1+26.0.1+dfsg-3` · all · trixie Affected nvd · rust-wasmtime · debian · 13

[Next results]

Last synced: Oct 28, 2026, 1:40:02 AM UTC

[CVE catalog]

Sources

Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Observed SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Result
match verified
Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Observed SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Result
match verified