Wasmtime development team reports:
- Out-of-bounds zero-length stream writes can panic.
- Host panic when component call_async is cancelled under some
conditions.
- Panic on erroneous call-to-host from guest realloc call.
- Yielding in a component start function can lead to a host panic.
- Panic when invoking an async-lifted function via call.
- Panic when pending calls are run after a trap.
- Stack overflow dropping a long chain of recursive types.
- Wasmtime may not properly enforce async-entrypoint requirement.
- Panic viewing component model stream or future as the wrong
type.
- Component-model handle tables are capped only per instance and
charged to no limit.
- Exception tags can cause host data structures to be unaligned.
- Filesystem sandbox escape when renaming symlinks with trailing
slashes.
- Overlapping string transcode in a fused adapter can panic.
- Guests can send absolute-form HTTP requests to different hosts.
- wasi-http: Request with long url before query parameter crashes
host.
- wasi-http: Guests can add conflicting content lengths to
messages
- wasi-http p3: forwarded trailers aren't checked against
is_forbidden_header hook
- wasi-http p3: Guests can set incorrect content-length for
spliced response bodies
- Cranelift backend on aarch64 can jump to incorrect target on
large Wasm br_table instruction
- Panic lowering a host-created component model stream into a
guest that expects a different payload type.