CVE-2025-61670

3 advisories.

crates.io/wasmtime-c-api-impl CVE-2025-61670: low 3.3, EPSS 0.19%

Wasmtime: Memory leak in C API with `externref` and `anyref` types

Action: Upgrade wasmtime-c-api-impl to 37.0.2 or later.

cargo update -p wasmtime-c-api-impl --precise 37.0.2

Affected

introduced	fixed	last affected
37.0.0	37.0.2	-

Fixed versions

37.0.2

Sources

CVE-2025-61670 · published 2026-07-14T17:48:35Z · modified 2026-07-14T18:00:14.986451643Z · JSON

PyPI/wasmtime-bin CVE-2025-61670: low 3.3, EPSS 0.19%

Wasmtime: Memory leak in C API with `externref` and `anyref` types

Action: Upgrade wasmtime-bin to 37.0.2 or later.

pip install wasmtime-bin==37.0.2

Affected

introduced	fixed	last affected
0	37.0.2	-

Fixed versions

37.0.2

Sources

CVE-2025-61670 · published 2026-07-14T17:48:35Z · modified 2026-07-14T18:00:14.986451643Z · JSON

PyPI/wasmtime-bin CVE-2025-61670: low 3.3, EPSS 0.19%

Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regress

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	37.0.0

Fixed versions

No fixed version in the source.

Sources

CVE-2025-61670 · published 2025-10-07T19:15:38.780Z · modified 2026-07-13T07:15:46.785932215Z · JSON