Stream: git-wasmtime

Topic: wasmtime / PR #13004 [42.0.x] Combined backports for a 42...

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:37):

alexcrichton opened PR #13004 from alexcrichton:ghsa-backports-42 to bytecodealliance:release-42.0.0:

Fixes for these issues:

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
  GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
  access.
  GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill.
  GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend.
  GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv

• Data leakage between pooling allocator instances.
  GHSA-6wgr-89rj-399p

• Host data leakage with 64-bit tables and Winch.
  GHSA-m9w2-8782-2946

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:37):

alexcrichton requested wasmtime-compiler-reviewers for a review on PR #13004.

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:37):

alexcrichton requested fitzgen for a review on PR #13004.

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:37):

alexcrichton requested wasmtime-default-reviewers for a review on PR #13004.

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:37):

alexcrichton requested wasmtime-core-reviewers for a review on PR #13004.

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:37):

cfallin submitted PR review.

Wasmtime GitHub notifications bot (Apr 09 2026 at 14:39):

alexcrichton has enabled auto merge for PR #13004.

Wasmtime GitHub notifications bot (Apr 09 2026 at 15:06):

alexcrichton updated PR #13004.

Wasmtime GitHub notifications bot (Apr 09 2026 at 15:47):

alexcrichton merged PR #13004.

Last updated: Apr 12 2026 at 23:10 UTC