Threats tagged 'ghsa-68fq-q9rp-8gvr'

Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contain a vulnerability that causes a panic (crash) when the host reads a component model stream as a different Rust item type than it was originally created with. This occurs because the host-to-host read path asserts matching TypeIds instead of returning an error, allowing guest code to trigger a crash by returning a host-created StreamReader<U> that the embedder reads as StreamReader<T>.