{"id":"JLSEC-2026-1356","summary":"Wasmtime has a possible panic when lifting `flags` component value","details":"### Impact\n\nWasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface.\n\nThis has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.\n\n### Patches\n\nWasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.\n\n### Workarounds\n\nThere is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.","modified":"2026-08-21T21:14:21.931266537Z","published":"2026-08-21T20:43:33.133Z","upstream":["CVE-2026-34943","EUVD-2026-21022","GHSA-m758-wjhj-p3jq"],"database_specific":{"license":"CC-BY-4.0","sources":[{"published":"2026-04-09T19:16:24.020Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34943","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34943","database_specific":{"status":"Analyzed"},"affected":{"bytecodealliance:wasmtime":["\u003c 24.0.7","\u003e= 25.0.0, \u003c 36.0.7","\u003e= 37.0.0, \u003c 42.0.2","\u003e= 43.0.0, \u003c 43.0.1"]},"id":"CVE-2026-34943","imported":"2026-08-21T20:09:02.076Z","modified":"2026-06-17T10:39:51.610Z"},{"modified":"2026-04-24T21:03:44Z","published":"2026-04-09T20:22:34Z","url":"https://api.github.com/advisories/GHSA-m758-wjhj-p3jq","html_url":"https://github.com/advisories/GHSA-m758-wjhj-p3jq","id":"GHSA-m758-wjhj-p3jq","imported":"2026-08-21T20:09:20.674Z"},{"url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-21022","html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21022","affected":{"bytecodealliance:wasmtime":["25.0.0, \u003c 36.0.7","37.0.0, \u003c 42.0.2","43.0.0, \u003c 44.0.1","\u003c 24.0.7"]},"id":"EUVD-2026-21022","imported":"2026-08-21T20:09:03.343Z","modified":"2026-04-13T20:15:23Z","published":"2026-04-09T18:36:51Z"}]},"references":[{"type":"WEB","url":"https://github.com/advisories/GHSA-m758-wjhj-p3jq"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34943"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0085.html"}],"affected":[{"package":{"name":"Wasmtime_jll","ecosystem":"Julia","purl":"pkg:julia/Wasmtime_jll?uuid=d20e7296-4f3e-515c-90b9-d2595a77bf72"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"45.0.1+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1356.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"credits":[{"name":"alexcrichton","contact":["https://github.com/alexcrichton"],"type":"OTHER"}]}