Repository navigation
chore(deps): update rust crate wasmtime-wasi to 49.0.3 [security] - #172
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/crate-wasmtime-wasi-vulnerability
branch
from
October 20, 2026 12:32
1c69c6e to
cb51b4d
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
49.0.2→49.0.3Filesystem sandbox escape when renaming symlinks with trailing slashes
GHSA-m9f7-9w4p-gv38 / RUSTSEC-2026-0352
More information
Details
This is an entry in the RustSec database for the Wasmtime security advisory
located at
GHSA-m9f7-9w4p-gv38
For more information see the GitHub-hosted security advisory.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:LReferences
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Release Notes
bytecodealliance/wasmtime (wasmtime-wasi)
v49.0.3Compare Source
49.0.3
Released 2026-10-14.
Fixed
Out-of-bounds zero-length stream writes can panic.
GHSA-93g3-36p8-x2gc
Host panic when component
call_asyncis cancelled under some conditions.GHSA-3r89-v5mq-j5xf
Panic on erroneous call-to-host from guest realloc call.
GHSA-7v24-42x9-pxf7
Yielding in a component start function can lead to a host panic.
GHSA-5hhx-4wrr-3j9g
Panic when invoking an async-lifted function via
call.GHSA-m6w2-jwq2-cv2c
Panic when pending calls are run after a trap.
GHSA-hmwq-g22x-qjw5
Stack overflow dropping a long chain of recursive types.
GHSA-wjc8-633q-pwxr
Wasmtime may not properly enforce async-entrypoint requirement.
GHSA-vcg5-q8m5-8379
Panic viewing component model stream or future as the wrong type.
GHSA-63h4-6cx9-pjfj
Component-model handle tables are capped only per instance and charged to no
limit.
GHSA-q554-3cjc-rx7p
Exception tags can cause host data structures to be unaligned.
GHSA-p79w-pv2r-29qp
Filesystem sandbox escape when renaming symlinks with trailing slashes.
GHSA-m9f7-9w4p-gv38
Overlapping string transcode in a fused adapter can panic.
GHSA-54p9-vhhq-8f7q
Guests can send absolute-form HTTP requests to different hosts.
GHSA-5qpp-g3j2-8frx
wasi-http: Request with long url before query parameter crashes host.GHSA-w36r-2hch-9xp9
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.