CVE-2026-34943 — Vulnerability in wasmtime — CVE Details

MEDIUM

Wasmtime has a possible panic when lifting `flags` component value

Published April 9, 2026Updated September 10, 2026Source: osv

Summary

### Impact Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. ### Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.

Advisory Timeline

First published April 9, 2026 (186 days ago).
Last revised September 10, 2026 — 153 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update wasmtime to 36.0.7 or later

cargo update -p wasmtime --precise 36.0.7

Cargo

Update wasmtime to 42.0.2 or later

cargo update -p wasmtime --precise 42.0.2

Cargo

Update wasmtime to 43.0.1 or later

cargo update -p wasmtime --precise 43.0.1

Cargo

Update wasmtime to 24.0.7 or later

cargo update -p wasmtime --precise 24.0.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
wasmtime	crates.io	All versions	36.0.7
wasmtime	crates.io	All versions	42.0.2
wasmtime	crates.io	43.0.0	43.0.1
wasmtime	crates.io	All versions	24.0.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-248
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34943?: Wasmtime has a possible panic when lifting `flags` component value This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-34943?: CVE-2026-34943 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34943 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-m758-wjhj-p3jq

RUSTSEC-2026-0085

Related CVEs

RUSTSEC-2026-0327
CRITICAL
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
CVE-2023-26489
CRITICAL
wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64
CVE-2022-24791
HIGH
Use after free in Wasmtime
CVE-2026-27572
MEDIUM
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
CVE-2026-35195
MEDIUM
Wasmtime has out-of-bounds write or crash when transcoding component model strings
CVE-2026-27204
MEDIUM
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
CVE-2026-35186
MEDIUM
Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend
CVE-2024-51745
LOW
Wasmtime doesn't fully sandbox all the Windows device filenames

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies