CVE-2026-34943

{
  "id": "CVE-2026-34943",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T19:16:24.020",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1."
    },
    {
      "lang": "es",
      "value": "Wasmtime es un runtime para WebAssembly. Antes de 24.0.7, 36.0.7, 42.0.2 y 43.0.1, Wasmtime contiene un posible pánico que puede ocurrir cuando un valor de modelo de componente de tipo ’flags’ es elevado con el tipo Val. Si los bits se establecen fuera del conjunto de ’flags’, el modelo de componente especifica que estos bits deben ser ignorados, pero Wasmtime entrará en pánico cuando este valor sea elevado. Este pánico solo afecta la implementación de Wasmtime de la elevación a Val, no cuando se usa la macro ’flags!’. Esto adicionalmente solo afecta a los valores de tipo ’flags’ que forman parte de una interfaz WIT. Esto tiene el riesgo de ser un pánico controlado por el invitado dentro del anfitrión que Wasmtime considera un vector de DoS. Esta vulnerabilidad está corregida en 24.0.7, 36.0.7, 42.0.2 y 43.0.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "bytecodealliance",
          "product": "wasmtime",
          "versions": [
            {
              "version": "< 24.0.7",
              "status": "affected"
            },
            {
              "version": ">= 25.0.0, < 36.0.7",
              "status": "affected"
            },
            {
              "version": ">= 37.0.0, < 42.0.2",
              "status": "affected"
            },
            {
              "version": ">= 43.0.0, < 44.0.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T20:15:13.926993Z",
          "id": "CVE-2026-34943",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*",
              "versionEndExcluding": "24.0.7",
              "matchCriteriaId": "5A39DBFB-CD5E-4551-8885-053DF90E277A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*",
              "versionStartIncluding": "25.0.0",
              "versionEndExcluding": "36.0.7",
              "matchCriteriaId": "B5AB2157-3977-49F9-9058-6B16A2556170"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*",
              "versionStartIncluding": "37.0.0",
              "versionEndExcluding": "42.0.2",
              "matchCriteriaId": "1D7B70EB-93E3-4732-AB70-E6A531178941"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*",
              "versionStartIncluding": "43.0.0",
              "versionEndExcluding": "43.0.1",
              "matchCriteriaId": "15FD6AA4-973B-4647-9222-40FBDC16A6FD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}