CVE-2026-34943

MEDIUM

Wasmtime has a possible panic when lifting `flags` component value

Published April 9, 2026Updated May 5, 2026Source: osv

Summary

### Impact Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. ### Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update wasmtime to 36.0.7 or later

cargo update -p wasmtime --precise 36.0.7

Cargo

Update wasmtime to 42.0.2 or later

cargo update -p wasmtime --precise 42.0.2

Cargo

Update wasmtime to 43.0.1 or later

cargo update -p wasmtime --precise 43.0.1

Cargo

Update wasmtime to 24.0.7 or later

cargo update -p wasmtime --precise 24.0.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Package	Ecosystem	Affected	Fixed In
wasmtime	crates.io	All versions	36.0.7
wasmtime	crates.io	All versions	42.0.2
wasmtime	crates.io	43.0.0	43.0.1
wasmtime	crates.io	All versions	24.0.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-248
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34943?: Wasmtime has a possible panic when lifting `flags` component value This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-34943?: CVE-2026-34943 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34943 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-m758-wjhj-p3jq

RUSTSEC-2026-0085

Related CVEs

CVE-2026-34971
CRITICAL
Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
CVE-2022-39393
HIGH
Wasmtime may have data leakage between instances in the pooling allocator
CVE-2026-34942
MEDIUM
Wasmtime: Panic when transcoding misaligned utf-16 strings
CVE-2026-34946
MEDIUM
Wasmtime has host panic when Winch compiler executes `table.fill`
CVE-2024-47763
MEDIUM
wasmtime has a runtime crash when combining tail calls with trapping imports
CVE-2026-34944
MEDIUM
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
CVE-2026-27195
MEDIUM
Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
CVE-2026-34945
LOW
Wasmtime has host data leakage with 64-bit tables and Winch

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies