deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m758-wjhj-p3jq
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: = 43.0.0
Patched in: 43.0.1

Summary: Wasmtime has a possible panic when lifting `flags` component value

Details:
### Impact

Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. 

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.
GitHub Security Advisory: GHSA-m758-wjhj-p3jq
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 37.0.0, < 42.0.2
Patched in: 42.0.2

Summary: Wasmtime has a possible panic when lifting `flags` component value

Details:
### Impact

Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. 

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.
GitHub Security Advisory: GHSA-m758-wjhj-p3jq
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 25.0.0, < 36.0.7
Patched in: 36.0.7

Summary: Wasmtime has a possible panic when lifting `flags` component value

Details:
### Impact

Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. 

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.
GitHub Security Advisory: GHSA-m758-wjhj-p3jq
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: < 24.0.7
Patched in: 24.0.7

Summary: Wasmtime has a possible panic when lifting `flags` component value

Details:
### Impact

Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. 

This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.
GitHub Security Advisory: GHSA-jxhv-7h78-9775
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-129: Improper Validation of Array Index
Vulnerable versions: = 43.0.0
Patched in: 43.0.1

Summary: Wasmtime: Panic when transcoding misaligned utf-16 strings

Details:
### Impact

Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. 

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-jxhv-7h78-9775
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-129: Improper Validation of Array Index
Vulnerable versions: >= 37.0.0, < 42.0.2
Patched in: 42.0.2

Summary: Wasmtime: Panic when transcoding misaligned utf-16 strings

Details:
### Impact

Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. 

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-jxhv-7h78-9775
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-129: Improper Validation of Array Index
Vulnerable versions: >= 25.0.0, < 36.0.7
Patched in: 36.0.7

Summary: Wasmtime: Panic when transcoding misaligned utf-16 strings

Details:
### Impact

Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. 

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-jxhv-7h78-9775
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-129: Improper Validation of Array Index
Vulnerable versions: < 24.0.7
Patched in: 24.0.7

Summary: Wasmtime: Panic when transcoding misaligned utf-16 strings

Details:
### Impact

Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. 

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-hx6p-xpx3-jvvv
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: = 43.0.0
Patched in: 43.0.1

Summary: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Details:
### Summary

Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.

This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.

A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.

### Impact

This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.

- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-hx6p-xpx3-jvvv
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 37.0.0, < 42.0.2
Patched in: 42.0.2

Summary: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Details:
### Summary

Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.

This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.

A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.

### Impact

This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.

- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-hx6p-xpx3-jvvv
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 25.0.0, < 36.0.7
Patched in: 36.0.7

Summary: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Details:
### Summary

Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.

This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.

A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.

### Impact

This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.

- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-hx6p-xpx3-jvvv
Package: wasmtime (RUST)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 24.0.7
Patched in: 24.0.7

Summary: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Details:
### Summary

Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.

This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.

A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.

### Impact

This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.

- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
GitHub Security Advisory: GHSA-hfpq-x728-986j
Package: netavark (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: >= 1.16.0, <= 1.17.0
Patched in: 1.17.1

Summary: netavark has incorrect error handling for malformed tcp packets

Details:
### Impact

A truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU.

### Patches
https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1

### Workarounds
None

### Credits

Thanks to @dkane01 for reporting this
GitHub Security Advisory: GHSA-v5hw-cv9c-rpg7
Package: libp2p-rendezvous (RUST)
Severity: HIGH (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 0.17.1
Patched in: 0.17.1

Summary: libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

Details:
### Summary
The rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue `DISCOVER` requests and force unbounded memory growth.

### Details

Pagination state is stored in:

```rs
HashMap<Cookie, HashSet<RegistrationId>>
```

On `Message::Discover`:

```
remote peer
→ DISCOVER
→ handle_request
→ registrations.get(...)
→ new cookie generated
→ cookie inserted into Registrations::cookies
```

There is **no upper bound or eviction policy**, so repeated DISCOVER requests grow this map indefinitely.


### PoC
A reproduction test and minimal harness will be provided in a private fork in a follow-up comment.

### Impact

**Remote state amplification leading to memory exhaustion.**


Properties:

- etwork reachable
- no authentication required
- low attack complexity
- protocol-compliant traffic

Impacts rendezvous nodes exposed to untrusted peers.
---

### Possible Fixes

1. **Global cap + eviction**

Bound cookie storage (`MAX_COOKIES_TRACKED`) with FIFO/expiry aware eviction.  
Tradeoff: attacker can churn cookies and evict legitimate pagination state.

2. **Stateless cookies**

Encode pagination state in authenticated cookies instead of storing server-side state.  
Tradeoff: more complex implementation.

3. **Rate limiting / per-peer quotas**

Limit cookie creation per peer.  
Tradeoff: requires peer tracking.
GitHub Security Advisory: GHSA-j3w3-p6mr-3hrh
Package: dyn-future (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: <= 3.0.4
Patched in: unpatched

Summary: DynFuture Drop Can Construct a Dangling Reference

Details:
DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.

This issue was reproduced against `dyn-future` 3.0.4 under Miri. The crate is unmaintained.
GitHub Security Advisory: GHSA-2c6h-4899-wjxr
Package: scaly (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write
Vulnerable versions: <= 0.0.37
Patched in: unpatched

Summary: scaly: Multiple soundness issues in Rust safe APIs

Details:
Affected versions contain multiple safe APIs that can trigger undefined behavior:

- `Array<T>::index` can perform an out-of-bounds read.
- `String::get_length` can perform an out-of-bounds read.
- `String::append_character` can perform an invalid write.
- `String::to_c_string` can perform an out-of-bounds write.

These issues were reproduced against `scaly` 0.0.37 under Miri. The crate is unmaintained.