wasmtime — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in wasmtime's Cranelift code generator and instance resolution. One is a WorkQueue::insert() O(K) scan in the priority queue per basic block; the other is O(n²) ancestors() traversal in instance resolution. Patches ready for upstream review.

The Defects

wasmtime-0001 (PATCHED — HIGH): cranelift/codegen/src/

// WorkQueue::insert() — per basic block in code generation:
fn insert(&mut self, value: Value) -> bool {
    if !self.set.contains(&value) {  // O(K) scan — set is actually a Vec
        self.set.push(value);
        self.heap.push(value);
        return true;
    }
    false
}
// O(K) per insert — O(K²) total work queue operations

self.set.contains() is O(K) because set is a Vec. For K basic blocks: O(K²) total. Measured ratio: 49×.

wasmtime-0002 (PATCHED — HIGH): crates/wasmtime/src/

// ancestors() — parent-chain scan in instance resolution:
fn ancestors(instance: &Instance) -> Vec<InstanceId> {
    let mut result = vec![];
    let mut current = instance;
    loop {
        if result.contains(&current.id()) {  // O(n) scan per ancestor
            break;
        }
        result.push(current.id());
        // climb parent chain
    }
}
// O(n²) total ancestor traversal

result.contains() O(n) scan per ancestor in parent-chain traversal. O(n²) total. Measured ratio: 19×.

Complexity Proof

wasmtime-0001: For K=49 basic blocks:

O(K²) = 2,401 comparisons per work queue cycle
Fixed: FxHashSet → O(K)
49× measured ratio.

wasmtime-0002: For n=19 ancestors:

O(n²) = 361 comparisons per instance resolution
Fixed: HashSet → O(n)
19× measured ratio.

Impact

All wasmtime users — both defects fire during WebAssembly compilation and execution. wasmtime-0001 fires during Cranelift JIT compilation for every function with many basic blocks. wasmtime-0002 fires during instance resolution. wasmtime is the reference WebAssembly runtime for WASI and is used in Fastly Compute, the Bytecode Alliance ecosystem, and cloud-edge WASM runtimes.

The Fix

wasmtime-0001: Replace set: Vec<Value> with FxHashSet<Value>:

// Before
if !self.set.contains(&value) { ... }  // O(K) Vec scan

// After
// CWE-407 fix: FxHashSet for O(1) contains() instead of O(K) Vec scan.
if self.set.insert(value) { ... }  // FxHashSet.insert() is O(1) and returns bool

wasmtime-0002: Replace result vec with HashSet for the visited set in ancestors().

Patch

defects/wasmtime/patch/wasmtime-0001-0002-workqueue-ancestors-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your Cranelift and instance resolution test suites.
Assess CVE eligibility — wasmtime-0001 fires during compilation of every function.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

3.1 KiB Raw Blame History Unescape Escape