How many CVEs have a located fix in bytecodealliance/wasmtime?

27 published CVEs have a fix traced to functions in bytecodealliance/wasmtime, touching 338 functions across 150 files.

Which function in bytecodealliance/wasmtime has been patched by the most CVEs?

hostcall_fuel in crates/wasmtime/src/runtime/component/store.rs has been changed by 2 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in bytecodealliance/wasmtime?

The median fix changes 119 lines. 22% of fixes change 20 lines or fewer, and 15% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

rust

c

#182 of 500 repositories

bytecodealliance/wasmtime

Name: bytecodealliance/wasmtime: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 2, 2026

27

CVE fixes located

Published CVEs

338

Functions patched

Distinct function sites

150

Files patched

Distinct source files

2021–2026

Years covered

By CVE publication date

Overview

27 published CVEs have a fix traced to functions in bytecodealliance/wasmtime, the earliest published in 2021. Those fixes changed 338 distinct functions across 150 files, in 1,935 patch hunks.

Among the 500 repositories tracked here, bytecodealliance/wasmtime ranks #182 by the number of CVEs with a located fix.

Most patched functions

Functions in bytecodealliance/wasmtime changed by the most CVE fixes.

Most patched files

Files in bytecodealliance/wasmtime changed by the most CVE fixes.

1crates/wasi/src/p1.rs4 CVEs · 8 functions
2crates/runtime/src/instance.rs3 CVEs · 11 functions
3crates/runtime/src/instance/allocator.rs3 CVEs · 9 functions
4crates/wasmtime/src/config.rs3 CVEs · 7 functions
5crates/cli-flags/src/lib.rs3 CVEs · 2 functions
6crates/wasi/src/p0.rs3 CVEs · 2 functions
7crates/wasi/src/p2/host/filesystem.rs3 CVEs · 2 functions
8crates/wasmtime/src/runtime/type_registry.rs2 CVEs · 15 functions
9crates/wasi-http/src/types_impl.rs2 CVEs · 10 functions
10crates/cranelift/src/compiler.rs2 CVEs · 6 functions

Fix size

How much code a CVE fix in bytecodealliance/wasmtime changes, with backports counted once.

119

Median lines changed

Added plus removed, per CVE

22%

Fixes of 20 lines or fewer

Share of CVE fixes

15%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in bytecodealliance/wasmtime, and the functions each fix changed.

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
CVE-2026-104855FuncEnvironment pre_translate_bulk_op manual_fuel_check
Low · CVSS 2.0
EPSS 0.3%2026-10-02
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
CVE-2026-58494test_ro_file_has_expected_contents Component test_file_has_expected_contents
Medium · CVSS 6.5
EPSS 0.2%2026-07-08
Wasmtime: Leak in WASIp1 `fd_renumber` implementation
CVE-2026-54786fd_renumber test_renumber_loop push_closed
Low · CVSS 2.3
EPSS 0.4%2026-07-01
Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
CVE-2026-27572main FieldMap consume_fuel
Medium · CVSS 6.9
EPSS 0.7%2026-02-24
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
CVE-2026-27204in
Medium · CVSS 6.9
EPSS 0.7%2026-02-24
Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
CVE-2026-27195main FieldMap consume_fuel
Medium · CVSS 6.9
EPSS 0.6%2026-02-24
Wasmtime provides unsound API access to a WebAssembly shared linear memory
CVE-2025-64345map Memory WasmCoreDump
Low · CVSS 1.8
EPSS 0.1%2025-11-12
Wasmtime vulnerable to segfault when using component resources
CVE-2025-62711wasmtime_setjmp trap InterpreterRef
Low · CVSS 2.1
EPSS 0.4%2025-10-24
Wasmtime has memory leak in C API with `externref` and `anyref` types
CVE-2025-61670wasmtime_val_t Drop from_wasmtime
Low · CVSS 1.0
EPSS 0.2%2025-10-07
Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations
CVE-2024-47813unregister_entry TypeRegistryInner register_new
Low · CVSS 1.0
EPSS 0.2%2024-10-09
Wasmtime runtime crash when combining tail calls with trapping imports
CVE-2024-47763unregister_entry Config iter
Medium · CVSS 6.8
EPSS 0.2%2024-10-09
Wasmtime vulnerable to panic when using a dropped extenref-typed element segment
CVE-2024-30266from_table_value init_func elements
Medium · CVSS 5.5
EPSS 0.3%2024-04-04

Get an alert for each new bytecodealliance/wasmtime CVE, with the patched functions and AI-written analysis.

Monitor wasmtime CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

axios/axios27 CVEs GNOME/gimp27 CVEs kanboard/kanboard27 CVEs MacWarrior/clipbucket-v527 CVEs nimiq/core-rs-albatross27 CVEs RIOT-OS/RIOT27 CVEs saltstack/salt27 CVEs strukturag/libheif27 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in bytecodealliance/wasmtime.

How many CVEs have a located fix in bytecodealliance/wasmtime?: 27 published CVEs have a fix traced to functions in bytecodealliance/wasmtime, touching 338 functions across 150 files.
Which function in bytecodealliance/wasmtime has been patched by the most CVEs?: hostcall_fuel in crates/wasmtime/src/runtime/component/store.rs has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in bytecodealliance/wasmtime?: The median fix changes 119 lines. 22% of fixes change 20 lines or fewer, and 15% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track bytecodealliance/wasmtime CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing