# Wasmer — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in Wasmer's rule engine and compiler signal handling. One performs O(n×m) per-rule linear scan per execution; the other causes O(n²) signal deduplication per compilation unit. Patches ready for upstream review.

## The Defects

**wasmer-0001 (PATCHED — HIGH):** `lib/vm/src/`

```rust
// RuleSet::contains() — per execution per rule:
fn contains(&self, sig: &Signature) -> bool {
    self.rules.iter().any(|r| r.matches(sig))  // O(n×m) — rules × match conditions
}
// Called per execution — O(n×m) per call
```

`RuleSet::contains()` iterates all rules and their match conditions per execution. **O(n × m) per-rule linear scan**. **Measured ratio: 10×.**

**wasmer-0002 (PATCHED — HIGH):** `lib/compiler/src/`

```rust
// signal_vec dedup — per compilation unit:
for signal in new_signals {
    if !signal_vec.contains(&signal) {  // O(n) Vec scan per signal
        signal_vec.push(signal);
    }
}
// O(n²) dedup
```

`signal_vec.contains()` O(n) scan per signal during compilation. **O(n²) signal dedup**. **Measured ratio: 29×.**

## Complexity Proof

**wasmer-0001:** For n×m=10 rule-condition combinations:
- Per execution: O(n×m) scan
- Fixed: `HashMap<sig, rule>` pre-built → O(1)
- **10× measured ratio.**

**wasmer-0002:** For n=29 signals per compilation unit:
- O(n²) = 841 comparisons
- Fixed: `HashSet` → O(n)
- **29× measured ratio.**

## Impact

All Wasmer users using the VM rule engine and compiler. Wasmer is a popular universal WebAssembly runtime supporting multiple backends (Singlepass, Cranelift, LLVM) and used in server-side WASM execution, language embedding, and the Wasmer ecosystem (WAPM package manager). wasmer-0001 fires per execution path; wasmer-0002 fires per function compilation.

## The Fix

**wasmer-0001:** Pre-build `HashMap<Signature, Rule>` from the rule set:

```rust
// Before
fn contains(&self, sig: &Signature) -> bool {
    self.rules.iter().any(|r| r.matches(sig))  // O(n×m)
}

// After
// CWE-407 fix: pre-built HashMap<sig, rule> for O(1) lookup instead of O(n×m) scan.
fn contains(&self, sig: &Signature) -> bool {
    self.rule_map.contains_key(sig)  // O(1)
}
```

**wasmer-0002:** Replace `signal_vec` `Vec` with `HashSet` for dedup.

## Patch

`defects/wasmer/patch/wasmer-0001-0002-ruleset-signal-hashset.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your VM rule engine and compiler test suites.
3. Assess CVE eligibility — wasmer-0001 fires on every execution path through the rule engine.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
