RUSTSEC-2026-0354 CVE-2026-119142 GHSA-3r89-v5mq-j5xf

Host panic when component `call_async` is cancelled under some conditions

Not rated yet crates.io

Severity: 0.0 / 10; Unknown · CVSS 4.0
Exploit chance (EPSS): 0.25%; Chance of exploitation in the next 30 days. Higher than 17.01% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 49.0.3; Upgrade wasmtime to this version or later

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory.

Affected versions

crates.io

Package	Vulnerable	Fixed in
wasmtime	`>= 46.0.0, < 48.0.6` `>= 49.0.0, < 49.0.3`	`48.0.6` `49.0.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

wasmtime crates.io → `49.0.3`

cargo

cargo update -p wasmtime --precise 49.0.3

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: Low
User interaction: Passive
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0354.html

Packages

crates.io/crates/wasmtime

Timeline

Oct 14, 2026 Published
Oct 30, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
RUSTSEC-2026-0424 Unchecked memory usage in transferring borrowed resources between components	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0423 Cross-engine type confusion with host-created struct-types-with-supertypes	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0422 Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check	Low	Also affects wasmtime
RUSTSEC-2026-0379 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction	Critical	Also affects wasmtime
GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type	Medium	Also affects wasmtime
GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation	Critical	Also affects wasmtime
RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit	Medium	Also affects wasmtime

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor