RUSTSEC-2026-0420 GHSA-hmmr-87qq-258j

wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving

Medium crates.io

Severity: 6.4 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 50.0.1; Upgrade wasmtime-wasi to this version or later

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j For more information see the GitHub-hosted security advisory.

Affected versions

crates.io

Package	Vulnerable	Fixed in
wasmtime-wasi	`>= 48.0.0, < 48.0.8` `>= 49.0.0, < 49.0.5` `>= 50.0.0, < 50.0.1`	`48.0.8` `49.0.5` `50.0.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

wasmtime-wasi crates.io → `50.0.1`

cargo

cargo update -p wasmtime-wasi --precise 50.0.1

Severity breakdown

CVSS 3.1 6.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0420.html

Packages

crates.io/crates/wasmtime-wasi

Timeline

Oct 29, 2026 Published
Oct 30, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0352 Filesystem sandbox escape when renaming symlinks with trailing slashes	Not rated yet	Also affects wasmtime-wasi
RUSTSEC-2026-0324 Guest can panic host through filesystem timestamp before the epoch on wasip3	Medium	Also affects wasmtime-wasi
RUSTSEC-2026-0321 WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption	Medium	Also affects wasmtime-wasi
RUSTSEC-2026-0323 fd_readdir copies uninitialized struct padding into guest memory	Low	Also affects wasmtime-wasi
RUSTSEC-2026-0322 Excessive allocated memory on the host when guests don't have stdio	Medium	Also affects wasmtime-wasi
RUSTSEC-2026-0314 Guest can panic host through filesystem datetime overflow	Medium	Also affects wasmtime-wasi
GHSA-4ch3-9j33-3pmj Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination	Medium	Also affects wasmtime-wasi
GHSA-3p27-qvp9-27qf Wasmtime has a leak in WASIp1 `fd_renumber` implementation	Medium	Also affects wasmtime-wasi

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor