Wasmer — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Wasmer's rule engine and compiler signal handling. One performs O(n×m) per-rule linear scan per execution; the other causes O(n²) signal deduplication per compilation unit. Patches ready for upstream review.

The Defects

wasmer-0001 (PATCHED — HIGH): lib/vm/src/

// RuleSet::contains() — per execution per rule:
fn contains(&self, sig: &Signature) -> bool {
    self.rules.iter().any(|r| r.matches(sig))  // O(n×m) — rules × match conditions
}
// Called per execution — O(n×m) per call

RuleSet::contains() iterates all rules and their match conditions per execution. O(n × m) per-rule linear scan. Measured ratio: 10×.

wasmer-0002 (PATCHED — HIGH): lib/compiler/src/

// signal_vec dedup — per compilation unit:
for signal in new_signals {
    if !signal_vec.contains(&signal) {  // O(n) Vec scan per signal
        signal_vec.push(signal);
    }
}
// O(n²) dedup

signal_vec.contains() O(n) scan per signal during compilation. O(n²) signal dedup. Measured ratio: 29×.

Complexity Proof

wasmer-0001: For n×m=10 rule-condition combinations:

Per execution: O(n×m) scan
Fixed: HashMap<sig, rule> pre-built → O(1)
10× measured ratio.

wasmer-0002: For n=29 signals per compilation unit:

O(n²) = 841 comparisons
Fixed: HashSet → O(n)
29× measured ratio.

Impact

All Wasmer users using the VM rule engine and compiler. Wasmer is a popular universal WebAssembly runtime supporting multiple backends (Singlepass, Cranelift, LLVM) and used in server-side WASM execution, language embedding, and the Wasmer ecosystem (WAPM package manager). wasmer-0001 fires per execution path; wasmer-0002 fires per function compilation.

The Fix

wasmer-0001: Pre-build HashMap<Signature, Rule> from the rule set:

// Before
fn contains(&self, sig: &Signature) -> bool {
    self.rules.iter().any(|r| r.matches(sig))  // O(n×m)
}

// After
// CWE-407 fix: pre-built HashMap<sig, rule> for O(1) lookup instead of O(n×m) scan.
fn contains(&self, sig: &Signature) -> bool {
    self.rule_map.contains_key(sig)  // O(1)
}

wasmer-0002: Replace signal_vec Vec with HashSet for dedup.

Patch

defects/wasmer/patch/wasmer-0001-0002-ruleset-signal-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your VM rule engine and compiler test suites.
Assess CVE eligibility — wasmer-0001 fires on every execution path through the rule engine.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Blame History Unescape Escape