CVE-2022-31146

Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior.

• CWE-416

• https://github.com/WebAssembly/reference-typesThird Party Advisory
• https://github.com/bytecodealliance/wasmtime/Product, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9gMitigation, Third Party Advisory
• https://github.com/WebAssembly/reference-typesThird Party Advisory
• https://github.com/bytecodealliance/wasmtime/Product, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9gMitigation, Third Party Advisory

Published

Jul 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3114An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31140Valinor is a PHP library that helps to map any input into a …9.1
• CVE-2022-31142@fastify/bearer-auth is a Fastify plugin to require bearer A…7.5
• CVE-2022-31143GLPI stands for Gestionnaire Libre de Parc Informatique and …5.3
• CVE-2022-31144Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-31145FlyteAdmin is the control plane for Flyte responsible for ma…6.5
• CVE-2022-31147The jQuery Validation Plugin (jquery-validation) provides dr…7.5
• CVE-2022-31148Shopware is an open source e-commerce software. In versions …5.4
• CVE-2022-31149ActivityWatch open-source automated time tracker. Versions p…9.6
• CVE-2022-3115An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31150undici is an HTTP/1.1 client, written from scratch for Node.…6.5
• CVE-2022-31151Authorization headers are cleared on cross-origin redirect. …6.5