CVE-2026-126410 · Package
NO FIX YET · SEE WHAT TO DO
A time-of-check/time-of-use race in the wasip3 wasi:sockets UDP implementation of wasmtime-wasi lets a malicious guest bypass send address restrictions. An attacker-controlled guest can deliver datagrams to addresses the policy only allows for receiving.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that embed Wasmtime and run untrusted WebAssembly guests with the wasip3 UDP socket interface enabled are exposed. Projects that do not run untrusted guests, or that do not use wasip3 UDP sockets, can skip it.
Not affected if no-untrusted-guests, wasip3-sockets-unused
Who cares rust, wasi, wasmtime, webassembly
wasmtime-wasi version in Cargo.lock or your dependency tree; affected are 48.0.0 to before 48.0.8, 49.0.0 to before 49.0.5, and 50.0.0 to before 50.0.1.wasi:sockets UDP interface for untrusted guests.wasmtime-wasi 48.0.8wasmtime-wasi 49.0.5wasmtime-wasi Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a time-of-check/time-of-use race in the wasip3 wasi:sockets udp-socket host implementation that lets guests bypass socket_addr_check send restrictions. A malicious guest can race udp-socket.send against udp-socket.connect to deliver attacker-controlled datagrams to addresses the policy permits only for receiving.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
50.0.1