{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"37.0.0"}],"component":"wasmtime-bin","cve_ids":["CVE-2025-61670"],"ecosystem":"PyPI","epss":0.00195,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vvp9-h8p2-xwfc","id":"tcs_01M5KGPHV62RSHG6E73MYBHAPM","modified_at":"2026-07-13T07:15:46.785932215Z","published_at":"2025-10-07T19:15:38.780Z","references":["https://osv.dev/vulnerability/PYSEC-2025-268","https://github.com/bytecodealliance/wasmtime/releases/tag/v37.0.2","https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vvp9-h8p2-xwfc"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"PYSEC-2025-268","url":"https://osv.dev/vulnerability/PYSEC-2025-268"}],"summary":"Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regress"}