{"action":"Upgrade wasmtime to 0.30.0 or later.","affected":[{"fixed":"0.30.0","introduced":"0.26.0"}],"component":"wasmtime","cve_ids":["CVE-2021-39216","CVE-2021-39218","CVE-2021-39219"],"ecosystem":"crates.io","epss":0.00307,"exploited":false,"fixed_versions":["0.30.0"],"ghsa_id":"GHSA-4873-36h9-wv49","id":"tcs_01M5KESDWMRZB4MVPACHM15689","modified_at":"2026-07-08T06:28:06.902042715Z","published_at":"2021-09-20T19:54:16Z","references":["https://osv.dev/vulnerability/GHSA-4873-36h9-wv49","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49","https://nvd.nist.gov/vuln/detail/CVE-2021-39218","https://github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11c","https://crates.io/crates/wasmtime","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime-py/compare/0.29.0...0.30.0","https://github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2021-321.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY","https://rustsec.org/advisories/RUSTSEC-2021-0110.html"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-4873-36h9-wv49","url":"https://osv.dev/vulnerability/GHSA-4873-36h9-wv49"}],"summary":"Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime"}