Host Panic in Wasmtime Package Due to Call Async Cancellation
Summary
RUSTSEC-2026-0354: Host panic when component call_async is cancelled under some conditions. Affects wasmtime across 2 version ranges.
>= 46.0.0, < 48.0.6
>= 49.0.0, < 49.0.3
Fixed in 48.0.6 or 49.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a runtime for WebAssembly that allows developers to run WebAssembly modules safely and efficiently. It provides a way to execute code written in languages that compile to WebAssembly, enabling high-performance applications across various platforms. However, a recent vulnerability has been identified that can lead to host panic when the call_async component is cancelled under certain conditions, potentially disrupting application functionality.
Vulnerability Detail
The vulnerability arises from the handling of asynchronous calls within the Wasmtime package. When a call_async operation is cancelled, it can lead to a host panic, which is a severe error that causes the host application to terminate unexpectedly. This issue can occur under specific conditions, making it critical for developers using Wasmtime to be aware of the potential for application crashes. The vulnerability has been assigned a CVSS score of 5.9, indicating a moderate severity level that could impact the stability of applications relying on this package.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.648.0.6 -
>= 49.0.0, < 49.0.349.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement error handling around the call_async function to catch potential panics and prevent the application from crashing. Here is a sample code snippet:
try {
call_async(...);
} catch (panic) {
// Handle the panic gracefully
log.error('Async call failed: ' + panic.message);
}
Conclusion
The vulnerability in the Wasmtime package poses a risk of host panic when the call_async function is cancelled. It is crucial for developers to update to the patched versions to ensure application stability. Implementing error handling can serve as a temporary workaround while updates are being applied.
See every vulnerability recorded for wasmtime →
FAQ
The vulnerability is related to host panic occurring when the call_async function is cancelled under certain conditions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions 48.0.6 and 49.0.3 of Wasmtime are safe to use as they contain fixes for the identified vulnerability.
If immediate updates are not possible, implement error handling around the call_async function to mitigate the impact of potential panics.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
