Overlapping string transcode in a fused adapter can panic

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · GitHub Advisory Database

   Detected

   This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory.

2. Oct 14, 2026 · GitHub Advisory Database

   Fix available

   wasmtime fixed in 49.0.3

3. Oct 14, 2026 · GitHub Advisory Database

   Fix available

   wasmtime fixed in 49.0.3

4. Oct 14, 2026 · GitHub Advisory Database

   Updated

   This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory.

Affected

• crates.io wasmtime49.0.0 → 49.0.3

Sources

• GitHub Advisory DatabaseGHSA-54p9-vhhq-8f7q

  GitHub Advisory Database record mirrored by OSV.

  github.com
• OSV.devRUSTSEC-2026-0360

  Overlapping string transcode in a fused adapter can panic

  osv.dev

References

• PACKAGE · crates.io
• WEB · github.com
• ADVISORY · rustsec.org