Debian/rust-wasmtime: low 2.6
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct paddin
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: DEBIAN-CVE-2026-115386#Debian:14/rust-wasmtime
- https://security-tracker.debian.org/tracker/CVE-2026-115386
published · modified · JSON