{"action":"Upgrade wasmtime to 40.0.4 or later.","affected":[{"fixed":"40.0.4","introduced":"39.0.0"},{"fixed":"41.0.4","introduced":"41.0.0"}],"component":"wasmtime","cve_ids":["CVE-2026-27195"],"ecosystem":"crates.io","epss":0.00412,"exploited":false,"fixed_versions":["40.0.4","41.0.4"],"ghsa_id":"GHSA-xjhv-v822-pf94","id":"tcs_01M5KF4RDTAQJ1MC348MCJAGHH","modified_at":"2026-09-10T03:50:36.264552698Z","published_at":"2026-02-24T20:44:46Z","references":["https://osv.dev/vulnerability/GHSA-xjhv-v822-pf94","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94","https://nvd.nist.gov/vuln/detail/CVE-2026-27195","https://github.com/bytecodealliance/wasmtime/commit/9e51c0d9a240a9613d279c061f82286bd11383fd","https://github.com/bytecodealliance/wasmtime/commit/d86b00736b9ece60b3c81e52f7a7e4cdd9f7d895","https://bytecodealliance.zulipchat.com/#narrow/channel/206238-general/topic/.E2.9C.94.20Panic.20in.20Wasmtime.2041.2E0.2E3.20.28runtime.2Fconcurrent.2Fcomponent.29/with/574438798","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime/releases/tag/v40.0.4","https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.4","https://rustsec.org/advisories/RUSTSEC-2026-0022.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xjhv-v822-pf94","url":"https://osv.dev/vulnerability/GHSA-xjhv-v822-pf94"}],"summary":"Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future"}