{"id":"EUVD-2024-3109","revision":null,"records":[{"revision":"9d3d0fa57273423881d7126a872e8706","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-47763","aliases":[],"title":"Wasmtime runtime crash when combining tail calls with trapping imports","description":"Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when Wasmtime is compiled with Rust 1.81 and later. WebAssembly tail calls are a proposal which relatively recently reached stage 4 in the standardization process. Wasmtime first enabled support for tail calls by default in Wasmtime 21.0.0, although that release contained a bug where it was only on-by-default for some configurations. In Wasmtime 22.0.0 tail calls were enabled by default for all configurations. The specific crash happens when an exported function in a WebAssembly module (or component) performs a `return_call` (or `return_call_indirect` or `return_call_ref`) to an imported host function which captures a stack trace (for example, the host function raises a trap). In this situation, the stack-walking code previously assumed there was always at least one WebAssembly frame on the stack but with tail calls that is no longer true. With the tail-call proposal it's possible to have an entry trampoline appear as if it directly called the exit trampoline. This situation triggers an internal assert in the stack-walking code which raises a Rust `panic!()`. When Wasmtime is compiled with Rust versions 1.80 and prior this means that an `extern \"C\"` function in Rust is raising a `panic!()`. This is technically undefined behavior and typically manifests as a process abort when the unwinder fails to unwind Cranelift-generated frames. When Wasmtime is compiled with Rust versions 1.81 and later this panic becomes a deterministic process abort. Overall the impact of this issue is that this is a denial-of-service vector where a malicious WebAssembly module or component can cause the host to crash. There is no other impact at this time other than availability of a service as the result of the crash is always a crash and no more. This issue was discovered by routine fuzzing performed by the Wasmtime project via Google's OSS-Fuzz infrastructure. We have no evidence that it has ever been exploited by an attacker in the wild. All versions of Wasmtime which have tail calls enabled by default have been patched: * 21.0.x - patched in 21.0.2 * 22.0.x - patched in 22.0.1 * 23.0.x - patched in 23.0.3  * 24.0.x - patched in 24.0.1 * 25.0.x - patched in 25.0.2. Wasmtime versions from 12.0.x (the first release with experimental tail call support) to 20.0.x (the last release with tail-calls off-by-default) have support for tail calls but the support is disabled by default. These versions are not affected in their default configurations, but users who explicitly enabled tail call support will need to either disable tail call support or upgrade to a patched version of Wasmtime. The main workaround for this issue is to disable tail support for tail calls in Wasmtime, for example with `Config::wasm_tail_call(false)`. Users are otherwise encouraged to upgrade to patched versions.","state":0,"publishedAt":"2024-10-09T18:03:33.944+00:00","modifiedAt":"2024-10-09T19:50:25.886+00:00","affected":[{"ecosystem":"Vendor product","name":"wasmtime","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"bytecodealliance\",\n                    \"product\": \"wasmtime\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 21.0.0, < 21.0.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 22.0.0, < 22.0.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 23.0.0, < 23.0.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 24.0.0, < 24.0.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 25.0.0, < 25.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg","https://github.com/bytecodealliance/wasmtime/pull/8540","https://github.com/bytecodealliance/wasmtime/pull/8682","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_tail_call","https://github.com/WebAssembly/proposals","https://github.com/webassembly/tail-call"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-47763","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-47763","identifiers":["CVE-2024-47763"]},"retained":false,"historicalAffected":[]},{"revision":"1624fee841c7484cbd0f5da8711f1076","observedAt":"2026-11-09T01:07:30.964+00:00","statement":{"source":"euvd","id":"EUVD-2024-3109","aliases":["CVE-2024-47763","GHSA-q8hx-mm92-4wvg"],"title":"Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if …","description":"Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when Wasmtime is compiled with Rust 1.81 and later. WebAssembly tail calls are a proposal which relatively recently reached stage 4 in the standardization process. Wasmtime first enabled support for tail calls by default in Wasmtime 21.0.0, although that release contained a bug where it was only on-by-default for some configurations. In Wasmtime 22.0.0 tail calls were enabled by default for all configurations. The specific crash happens when an exported function in a WebAssembly module (or component) performs a `return_call` (or `return_call_indirect` or `return_call_ref`) to an imported host function which captures a stack trace (for example, the host function raises a trap). In this situation, the stack-walking code previously assumed there was always at least one WebAssembly frame on the stack but with tail calls that is no longer true. With the tail-call proposal it's possible to have an entry trampoline appear as if it directly called the exit trampoline. This situation triggers an internal assert in the stack-walking code which raises a Rust `panic!()`. When Wasmtime is compiled with Rust versions 1.80 and prior this means that an `extern \"C\"` function in Rust is raising a `panic!()`. This is technically undefined behavior and typically manifests as a process abort when the unwinder fails to unwind Cranelift-generated frames. When Wasmtime is compiled with Rust versions 1.81 and later this panic becomes a deterministic process abort. Overall the impact of this issue is that this is a denial-of-service vector where a malicious WebAssembly module or component can cause the host to crash. There is no other impact at this time other than availability of a service as the result of the crash is always a crash and no more. This issue was discovered by routine fuzzing performed by the Wasmtime project via Google's OSS-Fuzz infrastructure. We have no evidence that it has ever been exploited by an attacker in the wild. All versions of Wasmtime which have tail calls enabled by default have been patched: * 21.0.x - patched in 21.0.2 * 22.0.x - patched in 22.0.1 * 23.0.x - patched in 23.0.3  * 24.0.x - patched in 24.0.1 * 25.0.x - patched in 25.0.2. Wasmtime versions from 12.0.x (the first release with experimental tail call support) to 20.0.x (the last release with tail-calls off-by-default) have support for tail calls but the support is disabled by default. These versions are not affected in their default configurations, but users who explicitly enabled tail call support will need to either disable tail call support or upgrade to a patched version of Wasmtime. The main workaround for this issue is to disable tail support for tail calls in Wasmtime, for example with `Config::wasm_tail_call(false)`. Users are otherwise encouraged to upgrade to patched versions.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5,"severity":null}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg","https://github.com/bytecodealliance/wasmtime/pull/8540","https://github.com/bytecodealliance/wasmtime/pull/8682","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_tail_call","https://github.com/WebAssembly/proposals","https://github.com/webassembly/tail-call"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3109","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 9, 2024, 6:03:33 PM","dateUpdated":"Oct 9, 2024, 7:50:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-3109","identifiers":["EUVD-2024-3109","CVE-2024-47763","GHSA-q8hx-mm92-4wvg"]},"retained":false,"historicalAffected":[]},{"revision":"865aee41b1944450b55091db6cf1fa4f","observedAt":"2026-10-25T00:17:35.237+00:00","statement":{"source":"nvd","id":"CVE-2024-47763","aliases":[],"title":"Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if …","description":"Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when Wasmtime is compiled with Rust 1.81 and later. WebAssembly tail calls are a proposal which relatively recently reached stage 4 in the standardization process. Wasmtime first enabled support for tail calls by default in Wasmtime 21.0.0, although that release contained a bug where it was only on-by-default for some configurations. In Wasmtime 22.0.0 tail calls were enabled by default for all configurations. The specific crash happens when an exported function in a WebAssembly module (or component) performs a `return_call` (or `return_call_indirect` or `return_call_ref`) to an imported host function which captures a stack trace (for example, the host function raises a trap). In this situation, the stack-walking code previously assumed there was always at least one WebAssembly frame on the stack but with tail calls that is no longer true. With the tail-call proposal it's possible to have an entry trampoline appear as if it directly called the exit trampoline. This situation triggers an internal assert in the stack-walking code which raises a Rust `panic!()`. When Wasmtime is compiled with Rust versions 1.80 and prior this means that an `extern \"C\"` function in Rust is raising a `panic!()`. This is technically undefined behavior and typically manifests as a process abort when the unwinder fails to unwind Cranelift-generated frames. When Wasmtime is compiled with Rust versions 1.81 and later this panic becomes a deterministic process abort. Overall the impact of this issue is that this is a denial-of-service vector where a malicious WebAssembly module or component can cause the host to crash. There is no other impact at this time other than availability of a service as the result of the crash is always a crash and no more. This issue was discovered by routine fuzzing performed by the Wasmtime project via Google's OSS-Fuzz infrastructure. We have no evidence that it has ever been exploited by an attacker in the wild. All versions of Wasmtime which have tail calls enabled by default have been patched: * 21.0.x - patched in 21.0.2 * 22.0.x - patched in 22.0.1 * 23.0.x - patched in 23.0.3  * 24.0.x - patched in 24.0.1 * 25.0.x - patched in 25.0.2. Wasmtime versions from 12.0.x (the first release with experimental tail call support) to 20.0.x (the last release with tail-calls off-by-default) have support for tail calls but the support is disabled by default. These versions are not affected in their default configurations, but users who explicitly enabled tail call support will need to either disable tail call support or upgrade to a patched version of Wasmtime. The main workaround for this issue is to disable tail support for tail calls in Wasmtime, for example with `Config::wasm_tail_call(false)`. Users are otherwise encouraged to upgrade to patched versions.","state":0,"publishedAt":"2024-10-09T18:15:08.863+00:00","modifiedAt":"2026-06-17T07:57:42.62+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5,"severity":"MEDIUM"}],"references":["https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_tail_call","https://github.com/WebAssembly/proposals","https://github.com/bytecodealliance/wasmtime/pull/8540","https://github.com/bytecodealliance/wasmtime/pull/8682","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg","https://github.com/webassembly/tail-call"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47763","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-670"],"productCriteria":["cpe:2.3:a:bytecodealliance:wasmtime:21.0.0:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:21.0.1:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:22.0.0:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:23.0.0:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:23.0.1:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:23.0.2:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:24.0.0:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:25.0.0:*:*:*:*:rust:*:*","cpe:2.3:a:bytecodealliance:wasmtime:25.0.1:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2024-10-09T18:15:08.863","lastModified":"2026-06-17T07:57:42.620"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-47763","identifiers":["CVE-2024-47763"]},"retained":false,"historicalAffected":[]},{"revision":"79c0631d8ec44be1ad71f7b30979ef7f","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-q8hx-mm92-4wvg","aliases":["CVE-2024-47763","PYSEC-2024-312","RUSTSEC-2024-0440"],"title":"wasmtime has a runtime crash when combining tail calls with trapping imports","description":"### Impact\n\nWasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when Wasmtime is compiled with Rust 1.81 and later.\n\n[WebAssembly tail calls](https://github.com/webassembly/tail-call) are a proposal which relatively recently reached stage 4 in the [standardization process](https://github.com/WebAssembly/proposals/). Wasmtime first enabled support for tail calls by default [in Wasmtime 21.0.0](https://github.com/bytecodealliance/wasmtime/pull/8540), although that release contained a bug where it was only on-by-default for some configurations. In [Wasmtime 22.0.0](https://github.com/bytecodealliance/wasmtime/pull/8682) tail calls were enabled by default for all configurations.\n\nThe specific crash happens when an exported function in a WebAssembly module (or component) performs a `return_call` (or `return_call_indirect` or `return_call_ref`) to an imported host function which captures a stack trace (for example, the host function raises a trap). In this situation, the stack-walking code previously assumed there was always at least one WebAssembly frame on the stack but with tail calls that is no longer true. With the tail-call proposal it's possible to have an entry trampoline appear as if it directly called the exit trampoline. This situation triggers an internal assert in the stack-walking code which raises a Rust `panic!()`.\n\nWhen Wasmtime is compiled with Rust versions 1.80 and prior this means that an `extern \"C\"` function in Rust is raising a `panic!()`. This is technically undefined behavior and typically manifests as a process abort when the unwinder fails to unwind Cranelift-generated frames. When Wasmtime is compiled with Rust versions 1.81 and later this panic becomes a deterministic process abort.\n\nOverall the impact of this issue is that this is a denial-of-service vector where a malicious WebAssembly module or component can cause the host to crash. There is no other impact at this time other than availability of a service as the result of the crash is always a crash and no more.\n\nThis issue was discovered by routine fuzzing performed by the Wasmtime project via Google's OSS-Fuzz infrastructure. We have no evidence that it has ever been exploited by an attacker in the wild.\n\n### Patches\n\nAll versions of Wasmtime which have tail calls enabled by default have been patched:\n\n* 21.0.x - patched in 21.0.2\n* 22.0.x - patched in 22.0.1\n* 23.0.x - patched in 23.0.3 \n* 24.0.x - patched in 24.0.1\n* 25.0.x - patched in 25.0.2\n\nWasmtime versions from 12.0.x (the first release with experimental tail call support) to 20.0.x (the last release with tail-calls off-by-default) have support for tail calls but the support is disabled by default. These versions are not affected in their default configurations, but users who explicitly enabled tail call support will need to either disable tail call support or upgrade to a patched version of Wasmtime.\n\n### Workarounds\n\nThe main workaround for this issue is to disable tail support for tail calls in Wasmtime, for example with [`Config::wasm_tail_call(false)`](https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_tail_call). Users are otherwise encouraged to upgrade to patched versions.\n\n### References\n\n* [Wasmtime's initial implementation of tail calls](https://github.com/bytecodealliance/wasmtime/pull/6774)\n* [Enabling of tail calls in 21.0.0](https://github.com/bytecodealliance/wasmtime/pull/8540)\n* [Fully enabling tail calls in 22.0.0](https://github.com/bytecodealliance/wasmtime/pull/8682)\n* [The WebAssembly's `tail-call` proposal](https://github.com/webassembly/tail-call)","state":0,"publishedAt":"2024-10-09T19:14:03+00:00","modifiedAt":"2026-09-10T03:50:19.9470279+00:00","affected":[{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0"},{"kind":"fixed","version":"21.0.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"22.0.0"},{"kind":"fixed","version":"22.0.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"23.0.0"},{"kind":"fixed","version":"23.0.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"24.0.0"},{"kind":"fixed","version":"24.0.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"25.0.0"},{"kind":"fixed","version":"25.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg","https://nvd.nist.gov/vuln/detail/CVE-2024-47763","https://github.com/bytecodealliance/wasmtime/pull/6774","https://github.com/bytecodealliance/wasmtime/pull/8540","https://github.com/bytecodealliance/wasmtime/pull/8682","https://github.com/bytecodealliance/wasmtime/commit/0ebe54d05f0e1f6c64b7c8bb48c9e9f6c95cacba","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_tail_call","https://github.com/WebAssembly/proposals","https://github.com/bytecodealliance/wasmtime","https://github.com/pypa/advisory-database/tree/main/vulns/wasmtime-bin/PYSEC-2024-312.yaml","https://github.com/webassembly/tail-call","https://rustsec.org/advisories/RUSTSEC-2024-0440.html"],"sourceUrl":"https://github.com/advisories/GHSA-q8hx-mm92-4wvg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q8hx-mm92-4wvg","identifiers":["GHSA-q8hx-mm92-4wvg","CVE-2024-47763","PYSEC-2024-312","RUSTSEC-2024-0440"]},"retained":false,"historicalAffected":[]},{"revision":"b2d5c974f90a42f6968714317dd8fa78","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0440","aliases":["CVE-2024-47763","GHSA-q8hx-mm92-4wvg","PYSEC-2024-312"],"title":"Runtime crash when combining tail calls with stack traces","description":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg.\nFor more information see the GitHub-hosted security advisory.","state":0,"publishedAt":"2024-10-02T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:12.4019244+00:00","affected":[{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"21.0.0"},{"kind":"fixed","version":"21.0.2"},{"kind":"introduced","version":"22.0.0"},{"kind":"fixed","version":"22.0.1"},{"kind":"introduced","version":"23.0.0"},{"kind":"fixed","version":"23.0.3"},{"kind":"introduced","version":"24.0.0"},{"kind":"fixed","version":"24.0.1"},{"kind":"introduced","version":"25.0.0"},{"kind":"fixed","version":"25.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/wasmtime","https://rustsec.org/advisories/RUSTSEC-2024-0440.html","https://github.com/bytecodealliance/wasmtime/pull/6774"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0440","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0440","identifiers":["RUSTSEC-2024-0440","CVE-2024-47763","GHSA-q8hx-mm92-4wvg","PYSEC-2024-312"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4268898+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4268987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T10:21:22.8157744+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8157744+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T10:21:50.2500014+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4276529+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4276532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b0b0499af228434598651aa5d221386e","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T10:21:49.6403901+00:00","lastSuccessAt":"2026-11-10T10:21:49.637+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T10:21:49.637+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T10:21:23.1241572+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1241572+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T10:21:22.8858542+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8858542+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T10:21:23.1397622+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1397622+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T10:21:23.0142877+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.0142877+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}