{"id":"RUSTSEC-2022-0075","revision":"d63ae38a1bce47a2bcbf8a024337479b","records":[{"revision":"d63ae38a1bce47a2bcbf8a024337479b","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2022-0075","aliases":["CVE-2022-39393","GHSA-wh6w-3828-g9qf","RUSTSEC-2022-0098"],"title":"Bug in pooling instance allocator","description":"bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance.\n\nMitigations are described [here](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf).","state":0,"publishedAt":"2022-11-10T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:05.1175347+00:00","affected":[{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"1.0.2"},{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/wasmtime","https://rustsec.org/advisories/RUSTSEC-2022-0075.html","https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0","https://github.com/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0075","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2022-0075","identifiers":["RUSTSEC-2022-0075","CVE-2022-39393","GHSA-wh6w-3828-g9qf","RUSTSEC-2022-0098"]},"retained":false,"historicalAffected":[]}],"coverage":[]}