CVE-2026-34988: Wasmtime Pooling Allocator Data Leakage Vulnerability
Summary
CVE-2026-34988: Wasmtime has data leakage between pooling allocator instances. Affects wasmtime across 3 version ranges.
>= 28.0.0, < 36.0.7
>= 37.0.0, < 42.0.2
>= 43.0.0, < 43.0.1
Fixed in 36.0.7, 42.0.2 or 43.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Wasmtime is a runtime for executing WebAssembly (Wasm) code, designed to provide a secure and efficient environment for running WebAssembly applications. It features a pooling allocator that optimizes memory usage by reusing memory allocations. However, a recent vulnerability has been identified that can lead to data leakage between instances, potentially compromising the security of applications relying on Wasmtime.
Vulnerability Detail
The vulnerability arises from a bug in Wasmtime's pooling allocator implementation, where the resetting of virtual memory permissions for linear memory is incorrectly determined. This issue occurs under specific configurations, allowing the contents of linear memory to leak from one instance to another. If the pooling allocator is in use, with certain configuration values set (memory_guard_size as 0, memory_reservation less than 4GiB, and max_memory_size equal to memory_reservation), the previous contents of linear memory can be accessed, violating WebAssembly's security model and breaking the sandboxing provided by Wasmtime.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 28.0.0, < 36.0.736.0.7 -
>= 37.0.0, < 42.0.242.0.2 -
>= 43.0.0, < 43.0.143.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Users can avoid this vulnerability by ensuring that at least one of the following conditions is met: 1) Use a pooling allocator that is not configured with memory_guard_size set to 0. 2) Set memory_reservation to 4GiB or more. 3) Ensure that max_memory_size is not equal to memory_reservation. For example, you can configure your Wasmtime settings in your Rust application as follows:
let config = wasmtime::Config::new()
.memory_guard_size(1 << 20) // Set to 1 MiB instead of 0
.memory_reservation(4 * 1024 * 1024 * 1024) // Set to 4 GiB or more
.max_memory_size(4 * 1024 * 1024 * 1024); // Match memory_reservation
Conclusion
In summary, the CVE-2026-34988 vulnerability in Wasmtime poses a risk of data leakage between instances due to improper handling of memory permissions. Users are advised to update to the latest patched versions or adjust their configurations to mitigate this issue.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score of this vulnerability is 2.3, indicating a low severity.
The vulnerability occurs when the pooling allocator is used with specific configurations: memory_guard_size set to 0, memory_reservation less than 4GiB, and max_memory_size equal to memory_reservation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
The patched versions of Wasmtime are 36.0.7, 42.0.2, and 43.0.1. It is recommended to update to one of these versions.
The impact includes potential data leakage between guest WebAssembly instances, which can compromise the security and integrity of applications running on Wasmtime.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
