Panic Lowering Vulnerability in Wasmtime: Host-Created Component Model Stream Mismatch
Summary
RUSTSEC-2026-0378: Panic lowering a host-created component model stream into a guest that expects a different payload type. Affects wasmtime across 2 version ranges.
>= 46.0.0, < 48.0.7
>= 49.0.0, < 49.0.4
Fixed in 48.0.7 or 49.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a runtime for WebAssembly that allows developers to run WebAssembly modules in various environments. It provides a secure and efficient way to execute code written in WebAssembly, making it a popular choice for applications that require high performance and safety. However, a recent vulnerability has been identified that affects the way Wasmtime handles component model streams created by hosts, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from a panic that occurs when a host-created component model stream is lowered into a guest that expects a different payload type. This mismatch can lead to unexpected behavior and potential exploitation by malicious actors. The issue is particularly concerning as it can allow attackers to manipulate the execution flow of the application, leading to unauthorized access or data corruption.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.748.0.7 -
>= 49.0.0, < 49.0.449.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the payload types expected by the guest and provided by the host are compatible. This may involve implementing additional checks or validations before lowering the stream to prevent mismatches.
Conclusion
The Panic Lowering Vulnerability in Wasmtime poses a significant risk due to the mismatch between host-created component model streams and guest expectations. Users are advised to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score of this vulnerability is 5.7, indicating a moderate level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your Cargo.lock file, you can check for vulnerabilities without needing to access the code.
If exploited, this vulnerability could allow attackers to manipulate the execution flow of applications, leading to unauthorized access or data corruption.
Yes, you can implement additional checks to ensure compatibility between the payload types expected by the guest and provided by the host as a temporary workaround.
More information can be found in the Wasmtime security advisory on GitHub at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
