Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

wasmtime-c-api-impl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.0crates.ioAmendedPublished

    Wasmtime: Memory leak in C API with externref and anyref types

    CVE-2025-61670 · GHSA-vvp9-h8p2-xwfc

    Affected
    • crates.io wasmtime-c-api-impl >= 37.0.0, < 37.0.2
    Fixed in
    37.0.2· Vendor fix available
    Issue
    Impact Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If anyref or externref is not used in the C/C++ API then embeddings are also unaffected by the leaky behavior. The wasmtime Rust crate is unaffected by this leak. Development of Wasmtime 37.0.0 included a refactoring in Rust of changing the old ManuallyRooted<T type to a new OwnedRooted<T type. This change was integrated into Wasmtime's C API but left the C API in a state which had memory leaks. Additionally the new ownership semantics around this type were not reflected into the C++ API, making it leak-prone. A short version of the change is that previously ManuallyRooted<T, as the name implies, required manual calls to an "unroot" operation. If this was forgotten then the memory was still cleaned up when the wasmtimestoret…

    Recommended action: Upgrade to 37.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →