Denial-of-Service Vulnerability in Rust-Wasmtime: Panic Induction via WASIp1 Functions
Summary
CVE-2025-53901: Wasmtime is a runtime for WebAssembly. Affects rust-wasmtime versions 26.0.1+dfsg-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rust-Wasmtime is a runtime for executing WebAssembly applications, providing a safe and efficient environment for running code compiled to WebAssembly. It supports various features, including the WASIp1 set of import functions, which allow WebAssembly modules to interact with the host environment. However, a specific bug in its implementation can lead to a denial-of-service condition, affecting the stability of applications using this runtime.
Vulnerability Detail
The vulnerability arises from a bug in Wasmtime's implementation of the WASIp1 set of import functions. It can be triggered by calling 'path_open' after 'fd_renumber' with either two equal argument values or a second argument equal to a previously-closed file descriptor. This corrupt state can lead to a panic in the host, which is considered a denial-of-service vector for WebAssembly embedders. While this panic does not introduce memory unsafety or allow WebAssembly to escape its sandbox, it can disrupt the host application, making it a significant security concern.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds for this vulnerability. Affected embeddings are strongly advised to update to a patched version of Wasmtime to avoid the panic in the host.
Conclusion
The vulnerability in Rust-Wasmtime poses a significant risk of denial-of-service due to a bug in the WASIp1 import functions. Users are urged to update to the patched versions to ensure the stability and security of their applications. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for rust-wasmtime →
FAQ
The vulnerability is a denial-of-service issue caused by a bug in the WASIp1 import functions, which can lead to a panic in the host when specific conditions are met.
No, the panic induced by this vulnerability does not lead to memory unsafety or allow WebAssembly to escape its sandbox.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Currently, there are no workarounds available. It is essential to prioritize updating to a patched version to mitigate the risk of a denial-of-service attack.
The patched versions are 24.0.4, 33.0.2, and 34.0.2. Users should upgrade to one of these versions to resolve the issue.
Related vulnerabilities
Recent vulnerabilities recorded for rust-wasmtime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
