{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"43.0.0"}],"component":"wasmtime","cve_ids":["CVE-2026-34983"],"ecosystem":"PyPI","epss":0.00121,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hfr4-7c6c-48w2","id":"tcs_01M5KGT1KVG4ZA3J0876W0XGKJ","modified_at":"2026-05-21T15:00:24.330171463Z","published_at":"2026-04-09T19:16:24.850Z","references":["https://osv.dev/vulnerability/PYSEC-2026-151","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"PYSEC-2026-151","url":"https://osv.dev/vulnerability/PYSEC-2026-151"}],"summary":"Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be trigg"}