{"id":"EUVD-2026-20990","enisaUuid":"f16a330e-8d0b-3d44-b41f-982160369fd9","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime\u0027s implementation of transcoding strings into the Component Model\u0027s utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","datePublished":"Apr 9, 2026, 6:32:56 PM","dateUpdated":"Apr 9, 2026, 7:36:13 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775\n","aliases":"CVE-2026-34942\nGHSA-jxhv-7h78-9775\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"063b42be-0469-3db8-9e83-2fbd933b3787","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.7"},{"id":"10c2353d-cd16-37cb-9b63-a3a596c08983","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"43.0.0, \u003c 44.0.1"},{"id":"66f8d571-dd7b-3d3c-be28-af2fc2397f3d","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 24.0.7"},{"id":"d67a3b7e-444c-356e-8ee1-eb520a2acdc9","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 42.0.2"}],"enisaIdVendor":[{"id":"450baa2c-1eb5-3a58-81a9-adf0711be784","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"97dad83f-8f48-3018-ba29-f98f3743aa06","vulnerability":{"id":"GHSA-jxhv-7h78-9775","description":"Wasmtime: Panic when transcoding misaligned utf-16 strings","datePublished":"Apr 9, 2026, 8:22:12 PM","dateUpdated":"Apr 24, 2026, 9:03:47 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34942\nhttps://github.com/bytecodealliance/wasmtime\nhttps://rustsec.org/advisories/RUSTSEC-2026-0092.html\n","enisa_id":"EUVD-2026-20990\n","aliases":"CVE-2026-34942\nGHSA-jxhv-7h78-9775\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e0a972f7-3015-3797-9b44-4daf3054df58","vulnerability":{"id":"CVE-2026-34942","description":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime\u0027s implementation of transcoding strings into the Component Model\u0027s utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","datePublished":"Apr 9, 2026, 6:32:56 PM","dateUpdated":"Apr 9, 2026, 7:36:13 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775\n","enisa_id":"EUVD-2026-20990\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"60e9a3f6-6b41-3ad7-b114-f3f23f68d769","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.7"},{"id":"893540e2-89a3-3ade-b1e5-8e90a015e14e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"43.0.0, \u003c 44.0.1"},{"id":"a7ba871b-ba7f-33e9-8697-7c4bb6e8e55c","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 42.0.2"},{"id":"e67fa8da-b89d-34dd-979b-461fb7323789","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 24.0.7"}],"vulnerabilityVendor":[{"id":"81748afe-b85b-302f-8ff1-aeedc1d6c440","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[{"id":"3ab67e21-a229-3f30-8538-a6bd13eb5390","advisory":{"id":"SUSE-SU-2026:21789-1","description":"Security update for tree-sitter","summary":"Security update for tree-sitter","datePublished":"May 14, 2026, 8:09:11 AM","dateUpdated":"Sep 29, 2026, 5:26:26 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21789-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202621789-1/\nhttps://lists.suse.com/pipermail/sle-updates/2026-May/046824.html\nhttps://bugzilla.suse.com/1259205\nhttps://bugzilla.suse.com/1261839\nhttps://bugzilla.suse.com/1261871\nhttps://bugzilla.suse.com/1261894\nhttps://bugzilla.suse.com/1261954\nhttps://bugzilla.suse.com/1261963\nhttps://bugzilla.suse.com/1261968\nhttps://bugzilla.suse.com/1261974\nhttps://bugzilla.suse.com/1262007\nhttps://bugzilla.suse.com/1262032\nhttps://bugzilla.suse.com/1262036\nhttps://bugzilla.suse.com/1262040\nhttps://www.suse.com/security/cve/CVE-2026-34941/\nhttps://www.suse.com/security/cve/CVE-2026-34942/\nhttps://www.suse.com/security/cve/CVE-2026-34943/\nhttps://www.suse.com/security/cve/CVE-2026-34944/\nhttps://www.suse.com/security/cve/CVE-2026-34945/\nhttps://www.suse.com/security/cve/CVE-2026-34946/\nhttps://www.suse.com/security/cve/CVE-2026-34987/\nhttps://www.suse.com/security/cve/CVE-2026-34988/\nhttps://www.suse.com/security/cve/CVE-2026-35186/\nhttps://www.suse.com/security/cve/CVE-2026-35195/\n","aliases":"CVE-2026-34941\nCVE-2026-34942\nCVE-2026-34943\nCVE-2026-34944\nCVE-2026-34945\nCVE-2026-34946\nCVE-2026-34987\nCVE-2026-34988\nCVE-2026-35186\nCVE-2026-35195\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"01851624-fbed-34f6-9177-ac59eb1400c0","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"07906a64-728b-3906-8470-06eec21f49a5","product":{"name":"libtree-sitter0_26-x86-64-v3-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0adb602e-605f-31b6-9117-e8ca784ce76a","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1400626c-30cd-3864-b6a9-182a4bd2358a","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"1bfa8258-0b70-350a-922e-f03fcadff58f","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"260a1a1f-8e03-3cea-a530-615e8402d236","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"27a1de74-ec6f-377b-aad0-9b332f66ab76","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"34c29c81-e91b-3d6e-8707-3a4d3c07c6e4","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4fcfd168-bbab-3b0d-a23c-1792516c9315","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5326f691-16a9-355c-85c5-7b2a36582150","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6436e314-1782-3074-81cc-940f870f1ee3","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"85635639-7159-394a-bb88-158aa7480119","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}},{"id":"8855c1ea-ad18-33fe-aa32-e0a6cbb4b5e1","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a499603f-86ad-302e-9800-f8754041ba23","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"af61517d-f993-3c93-9e39-72517f8c567c","product":{"name":"libtree-sitter0_26-x86-64-v3-0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"af9e599c-9827-3038-abd3-810004e1db30","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"c4c02bfb-c8e2-3ed4-b881-64c43bf06b74","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d7b67c17-3cb9-3549-9e98-5384349bf65b","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"df66d873-e4be-3bf7-abb8-809f757392fc","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ea47a3c1-9419-37e6-b812-f3266e285a5a","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"c866ba0b-8b70-356f-b1ad-f4c80a65d182","advisory":{"id":"openSUSE-SU-2026:20749-1","description":"Security update for tree-sitter","summary":"Security update for tree-sitter","datePublished":"May 14, 2026, 8:07:53 AM","dateUpdated":"Sep 29, 2026, 5:31:22 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20749-1.json\nhttps://bugzilla.suse.com/1259205\nhttps://bugzilla.suse.com/1261839\nhttps://bugzilla.suse.com/1261871\nhttps://bugzilla.suse.com/1261894\nhttps://bugzilla.suse.com/1261954\nhttps://bugzilla.suse.com/1261963\nhttps://bugzilla.suse.com/1261968\nhttps://bugzilla.suse.com/1261974\nhttps://bugzilla.suse.com/1262007\nhttps://bugzilla.suse.com/1262032\nhttps://bugzilla.suse.com/1262036\nhttps://bugzilla.suse.com/1262040\nhttps://www.suse.com/security/cve/CVE-2026-34941/\nhttps://www.suse.com/security/cve/CVE-2026-34942/\nhttps://www.suse.com/security/cve/CVE-2026-34943/\nhttps://www.suse.com/security/cve/CVE-2026-34944/\nhttps://www.suse.com/security/cve/CVE-2026-34945/\nhttps://www.suse.com/security/cve/CVE-2026-34946/\nhttps://www.suse.com/security/cve/CVE-2026-34987/\nhttps://www.suse.com/security/cve/CVE-2026-34988/\nhttps://www.suse.com/security/cve/CVE-2026-35186/\nhttps://www.suse.com/security/cve/CVE-2026-35195/\n","aliases":"CVE-2026-34941\nCVE-2026-34942\nCVE-2026-34943\nCVE-2026-34944\nCVE-2026-34945\nCVE-2026-34946\nCVE-2026-34987\nCVE-2026-34988\nCVE-2026-35186\nCVE-2026-35195\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05a5180b-019b-3bc0-842e-6e10b13980aa","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"091ff1ee-8d0a-3d7a-84a6-974ec06bdd61","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"186339de-7392-332c-ae2a-d52668025bf4","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2c4b7093-90ac-3e4b-a5f2-9c435c558dbc","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2f03a92a-d648-36bb-a099-32561164df42","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5181887b-e734-3865-a234-0646418c1be5","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5a1f6f47-f16c-3430-b69c-16f6d8a833dc","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"60c9ec65-b40b-3a55-869e-d50306f09f2e","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6735312c-af30-39da-807a-5879276e3edb","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"689284a1-2e59-33c7-b34d-48b45bbccc44","product":{"name":"libtree-sitter0_26-x86-64-v3-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6b7ff6e6-bb5d-36c0-9731-9680609b3477","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"715c5727-93a3-3ae8-9fc7-d71e42c658fc","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8ceaa785-018b-3ca1-81bc-f8c1c47bb415","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"efd8df71-48e5-334f-a296-b9efdd95c089","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}