Wasmtime Vulnerability in WASIp1 `fd_renumber` Implementation
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- HIGH
- Affected component
- wasmtime (cargo)
- Affected versions
- < 24.0.6 or >= 25.0.0, < 36.0.6 or >= 37.0.0, < 40.0.4 or < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 2.0.0, < 2.0.2 or < 1.0.2 or >= 0.26.0, < 0.30.0 or >= 38.0.0, < 38.0.3 or >= 0.37.0, < 0.38.2 or >= 28.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 19.0.0, < 19.0.1 or >= 19.0.0, <= 19.0.0 or < 0.38.2 or >= 19.0.0, < 21.0.2 or >= 22.0.0, < 22.0.1 or >= 23.0.0, < 23.0.3 or >= 24.0.0, < 24.0.1 or >= 25.0.0, < 25.0.2 or < 24.0.6 or >= 25.0.0, < 36.0.6 or >= 37.0.0, < 40.0.4 or >= 0.34.0, < 0.34.1 or >= 0.34.0, <= 0.34.0 or < 0.33.1 or < 24.0.2 or >= 25.0.0, < 25.0.3 or >= 26.0.0, < 26.0.1 or >= 26.0.0, <= 26.0.0 or < 6.0.2 or >= 7.0.0, < 7.0.1 or >= 8.0.0, < 8.0.1 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 0.37.0, < 4.0.1 or >= 5.0.0, < 5.0.1 or >= 6.0.0, < 6.0.1 or >= 10.0.0, < 24.0.4 or >= 33.0.0, < 33.0.2 or >= 34.0.0, < 34.0.2 or >= 10.0.0, < 10.0.2 or >= 11.0.0, < 11.0.2 or >= 12.0.0, < 12.0.2 or < 0.34.2 or >= 0.35.0, < 0.35.2 or >= 2.0.0, < 2.0.2 or < 1.0.2 or >= 38.0.0, < 38.0.4 or >= 37.0.0, < 37.0.3 or >= 26.0.0, < 36.0.3 or < 24.0.5 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 32.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or < 0.38.1 or < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 30.0.0, < 36.0.8 or >= 37.0.0, < 43.0.2 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or < 0.30.0 or >= 12.0.0, < 21.0.2 or >= 22.0.0, < 22.0.1 or >= 23.0.0, < 23.0.3 or >= 24.0.0, < 24.0.1 or >= 25.0.0, < 25.0.2 or < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or < 0.30.0 or >= 29.0.0, < 36.0.5 or >= 37.0.0, < 40.0.3 or >= 41.0.0, < 41.0.1 or >= 41.0.0, <= 41.0.0 or >= 2.0.0, < 2.0.2 or < 1.0.2 or >= 39.0.0, < 40.0.4 or >= 41.0.0, < 41.0.4 or >= 1.0.0, < 4.0.1 or >= 5.0.0, < 5.0.1 or >= 6.0.0, < 6.0.1 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, <= 43.0.0 or >= 0.0.0-0, < 0.30.0 or >= 0.34.0, < 0.34.2 or >= 0.35.0, < 0.35.2 or >= 0.0.0-0, < 1.0.2 or >= 2.0.0, < 2.0.2 or >= 0.0.0-0, < 1.0.2 or >= 2.0.0, < 2.0.2 or >= 0.0.0-0, < 0.38.1 or >= 0.0.0-0, < 0.33.1 or >= 0.34.0, < 0.34.1 or >= 0.0.0-0, < 1.0.2 or >= 2.0.0, < 2.0.2 or >= 0.0.0-0, < 1.0.2 or >= 2.0.0, < 2.0.2 or >= 0.0.0-0, < 0.34.2 or >= 0.35.0, < 0.35.2 or >= 0.0.0-0, < 0.38.2 or >= 0.0.0-0, < 0.38.2 or >= 0.0.0-0, < 1.0.2 or >= 2.0.0, < 2.0.2 or >= 0.0.0-0, < 4.0.1 or >= 5.0.0, < 5.0.1 or >= 6.0.0, < 6.0.1 or >= 0.0.0-0, < 10.0.2 or >= 11.0.0, < 11.0.2 or >= 12.0.0, < 12.0.2 or >= 0.0.0-0, < 6.0.2 or >= 7.0.0, < 7.0.1 or >= 8.0.0, < 8.0.1 or >= 0.0.0-0, < 4.0.1 or >= 5.0.0, < 5.0.1 or >= 6.0.0, < 6.0.1 or >= 0.0.0-0, < 24.0.2 or >= 25.0.0, < 25.0.3 or >= 26.0.0, < 26.0.1 or >= 19.0.0, < 21.0.2 or >= 22.0.0, < 22.0.1 or >= 23.0.0, < 23.0.3 or >= 24.0.0, < 24.0.1 or >= 25.0.0, < 25.0.2 or >= 21.0.0, < 21.0.2 or >= 22.0.0, < 22.0.1 or >= 23.0.0, < 23.0.3 or >= 24.0.0, < 24.0.1 or >= 25.0.0, < 25.0.2 or >= 19.0.0, < 19.0.1 or >= 10.0.0, < 24.0.4 or >= 25.0.0, < 33.0.2 or >= 34.0.0, < 34.0.2 or >= 38.0.0, < 38.0.3 or >= 0.0.0-0, < 24.0.5 or >= 25.0.0, < 36.0.3 or >= 37.0.0, < 37.0.3 or >= 38.0.0, < 38.0.4 or >= 29.0.0, < 36.0.5 or >= 37.0.0, < 40.0.3 or >= 41.0.0, < 41.0.1 or >= 0.0.0-0, < 24.0.6 or >= 25.0.0, < 36.0.6 or >= 37.0.0, < 40.0.4 or >= 41.0.0, < 41.0.4 or >= 0.0.0-0, < 24.0.6 or >= 25.0.0, < 36.0.6 or >= 37.0.0, < 40.0.4 or >= 41.0.0, < 41.0.4 or >= 39.0.0, < 40.0.4 or >= 41.0.0, < 41.0.4 or >= 0.0.0-0, < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 24.0.7 or >= 25.0.0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 0.0.0-0, < 36.0.7 or >= 37.0.0, < 42.0.2 or >= 43.0.0, < 43.0.1 or >= 30.0.0, < 36.0.8 or >= 37.0.0, < 43.0.2 or >= 44.0.0, < 44.0.1 or >= 0.0.0-0, < 24.0.12 or >= 25.0.0, < 36.0.13 or >= 37.0.0, < 46.0.2 or >= 47.0.0, < 47.0.3 or >= 46.0.0, < 46.0.2 or >= 47.0.0, < 47.0.3 or >= 46.0.0, < 46.0.3 or >= 47.0.0, < 47.0.4 or >= 0.0.0-0, < 24.0.13 or >= 25.0.0, < 36.0.14 or >= 37.0.0, < 46.0.3 or >= 47.0.0, < 47.0.4
- Patched version
- Not yet available
GHSA-3P27-QVP9-27QF
Wasmtime's native implementation of WASIp1 reportedly suffers from a leak in the `fd_renumber` function, causing resource leaks in the host. This issue affects runtimes that load core wasm modules and expose `fd_renumber`.
What happened
A vulnerability has been identified in Wasmtime's native implementation of the WASIp1 `fd_renumber` function. This bug causes resource leaks in the host environment. The vulnerability is present in various versions of Wasmtime, as detailed in the affected components section. It is crucial for users to assess their exposure by checking the version of Wasmtime they are using against the provided version ranges.
The vulnerability was first flagged on 2026-08-26T14:30:10+00:00 and is currently under investigation. No exploitation in the wild has been confirmed at this time. Users are advised to update to the recommended versions to mitigate potential risks.
What to do about it
- Update to Wasmtime 24.0.10, 36.0.11, 44.0.3, or 45.0.2 to fix the issue.
- Check your current Wasmtime version against the affected version ranges provided to determine if an update is necessary.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
wasmtime is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Wasmtime versions < 24.0.6 or >= 25.0.0, < 36.0.6 or >= 37.0.0, and so on as listed in the affected components section.
What should I do right now?
Update to Wasmtime 24.0.10, 36.0.11, 44.0.3, or 45.0.2 to mitigate the vulnerability.
Is this vulnerability being exploited in the wild?
No exploitation in the wild has been confirmed at this time.