Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Alex Crichton

#41905of 60,587
7.5Total CVSS
Vulnerabilities · 1
PT-2026-21804
2026-02-24
7.5
CVE-2026-27195
Wasmtime
Wasmtime
Wasmtime, a runtime for WebAssembly, can experience a panic when the host embedder drops the future returned by `wasmtime::component::[Typed]Func::call async` before it resolves, and then calls the same function again with the same component instance. This occurs because the component instance enters a non-reenterable state, leading to a trap and subsequent panic during task disposal. The issue arises from a bug in the implementation of `[Typed]Func::call async` introduced with the `component-model-async` feature, which became the default starting with version 39.0.0. The `API Endpoint` involved is `wasmtime::component::[Typed]Func::call async`. The `variable` representing the returned future is not explicitly named, but its improper handling triggers the issue. The issue does not affect embeddings with the `component-model-async` compile-time feature disabled.