{"action":"Upgrade wasmtime to 48.0.7 (48.x) or 49.0.4 (49.x) or later.","affected":[{"fixed":"48.0.7","introduced":"46.0.0"},{"fixed":"49.0.4","introduced":"49.0.0"}],"component":"wasmtime","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["48.0.7","49.0.4"],"ghsa_id":"GHSA-9pvw-hwfg-92h5","id":"tcs_01M5NDPVRCM8B5JCS214RKCE73","modified_at":"2026-10-23T22:15:05.191681724Z","published_at":"2026-10-23T22:04:45Z","references":["https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5","https://github.com/bytecodealliance/wasmtime/pull/14819","https://github.com/bytecodealliance/wasmtime/pull/14820","https://github.com/bytecodealliance/wasmtime/pull/14827","https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158","https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","https://rustsec.org/advisories/RUSTSEC-2026-0378.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-9pvw-hwfg-92h5","url":"https://osv.dev/vulnerability/GHSA-9pvw-hwfg-92h5"}],"summary":"Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type"}