https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:42:29 +0000 https://cve.radiocsirt.org/vuln/cve-2025-61670 <p><strong>Affected:</strong> bytecodealliance wasmtime</p> <p>Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If `anyref` or `externref` is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The `wasmtime` Rust crate is unaffected by this leak.</p> <p>Development of Wasmtime 37.0.0 included a refactoring in Rust of changing the old `ManuallyRooted&lt;T&gt;` type to a new `OwnedRooted&lt;T&gt;` type. This change was integrated into Wasmtime&#39;s C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously `ManuallyRooted&lt;T&gt;`, as the name implies, required manual calls to an &#34;unroot&#34; operation. If this was forgotten then the memory was still cleaned up when the `wasmtime_store_t` itself was destroyed eventually. Documentation of when to &#34;unroot&#34; was sparse and there were already situations prior to 37.0.0 where memory would be leaked until the store was destroyed anyway. All memory, though, was always bound by the store, and destroying the store would guarantee that there were no memory leaks.</p> <p>In migrating to `OwnedRooted&lt;T&gt;` the usage of the type in Rust changed. A manual &#34;unroot&#34; operation is no longer required an…</p> <p><strong>Affected:</strong> bytecodealliance wasmtime</p> <p>Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If `anyref` or `externref` is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The `wasmtime` Rust crate is unaffected by this leak.</p> <p>Development of Wasmtime 37.0.0 included a refactoring in Rust of changing the old `ManuallyRooted&lt;T&gt;` type to a new `OwnedRooted&lt;T&gt;` type. This change was integrated into Wasmtime&#39;s C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously `ManuallyRooted&lt;T&gt;`, as the name implies, required manual calls to an &#34;unroot&#34; operation. If this was forgotten then the memory was still cleaned up when the `wasmtime_store_t` itself was destroyed eventually. Documentation of when to &#34;unroot&#34; was sparse and there were already situations prior to 37.0.0 where memory would be leaked until the store was destroyed anyway. All memory, though, was always bound by the store, and destroying the store would guarantee that there were no memory leaks.</p> <p>In migrating to `OwnedRooted&lt;T&gt;` the usage of the type in Rust changed. A manual &#34;unroot&#34; operation is no longer required an…</p> https://cve.radiocsirt.org/vuln/cve-2025-61670 https://cve.radiocsirt.org/vuln/ghsa-vvp9-h8p2-xwfc <p><strong>Affected:</strong> crates.io: wasmtime-c-api-impl, PyPI: wasmtime-bin</p> <p>### Impact</p> <p>Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If `anyref` or `externref` is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The `wasmtime` Rust crate is unaffected by this leak.</p> <p>Development of Wasmtime 37.0.0 included a refactoring in Rust of changing the old `ManuallyRooted&lt;T&gt;` type to a new `OwnedRooted&lt;T&gt;` type. This change was integrated into Wasmtime&#39;s C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously `ManuallyRooted&lt;T&gt;`, as the name implies, required manual calls to an &#34;unroot&#34; operation. If this was forgotten then the memory was still cleaned up when the `wasmtime_store_t` itself was destroyed eventually. Documentation of when to &#34;unroot&#34; was sparse and there were already situations prior to 37.0.0 where memory would be leaked until the store was destroyed anyway. All memory, though, was always bound by the store, and destroying the store would guarantee that there were no memory leaks.</p> <p>In migrating to `OwnedRooted&lt;T&gt;` the usage of the type in Rust changed. A manual &#34;unroot&#34; operation is no longer required and it happens naturally as a…</p> <p><strong>Affected:</strong> crates.io: wasmtime-c-api-impl, PyPI: wasmtime-bin</p> <p>### Impact</p> <p>Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If `anyref` or `externref` is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The `wasmtime` Rust crate is unaffected by this leak.</p> <p>Development of Wasmtime 37.0.0 included a refactoring in Rust of changing the old `ManuallyRooted&lt;T&gt;` type to a new `OwnedRooted&lt;T&gt;` type. This change was integrated into Wasmtime&#39;s C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously `ManuallyRooted&lt;T&gt;`, as the name implies, required manual calls to an &#34;unroot&#34; operation. If this was forgotten then the memory was still cleaned up when the `wasmtime_store_t` itself was destroyed eventually. Documentation of when to &#34;unroot&#34; was sparse and there were already situations prior to 37.0.0 where memory would be leaked until the store was destroyed anyway. All memory, though, was always bound by the store, and destroying the store would guarantee that there were no memory leaks.</p> <p>In migrating to `OwnedRooted&lt;T&gt;` the usage of the type in Rust changed. A manual &#34;unroot&#34; operation is no longer required and it happens naturally as a…</p> https://cve.radiocsirt.org/vuln/ghsa-vvp9-h8p2-xwfc