Upcoming Security Release for Wasmtime on 2024-10-09

[Alex Crichton]

The Wasmtime project would like to announce a forthcoming security release of Wasmtime.

The release will be made available on 2024-10-09 at approximately 19:00 UTC. Additionally, an advisory will be made available on the same date and time at https://github.com/advisories.

The highest severity issue fixed in this release is MODERATE based on the classification scheme defined by CVSS.

[Alex Crichton]

[Update 2024-10-09] Security releases available

Wasmtime versions 21.0.2, 22.0.1, 23.0.3, 24.0.1, and 25.0.2 are now available on crates.io. Additionally, binary releases are available on Github for the Wasmtime C-API shared library and CLI at https://github.com/bytecodealliance/wasmtime/releases.

This release fixes the following security issues rated MODERATE:

 

  Runtime crash when combining tail calls with stack traces

  https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg

This release fixes the following security issues rated LOW:

  Race condition could lead to WebAssembly control-flow integrity and type safety violations

  https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7qmx-3fpx-r45m