Component-model handle tables are capped only per instance and charged to no limit

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• wasmtime · crates.io

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · GitHub Advisory Database

   Detected

   This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory.

2. Oct 14, 2026 · GitHub Advisory Database

   Fix available

   wasmtime fixed in 36.0.18

3. Oct 14, 2026 · GitHub Advisory Database

   Fix available

   wasmtime fixed in 36.0.18

4. Oct 14, 2026 · GitHub Advisory Database

   Updated

   This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory.

Affected

• crates.io wasmtime0.0.0-0 → 36.0.18

Sources

• GitHub Advisory DatabasePackage advisoryGHSA-q554-3cjc-rx7p

  GitHub Advisory Database record mirrored by OSV.

  github.com
• OSV.devPackage advisoryRUSTSEC-2026-0363

  Component-model handle tables are capped only per instance and charged to no limit

  osv.dev

References

• PACKAGE · crates.io
• WEB · github.com
• ADVISORY · rustsec.org