https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw reports:
+++ +Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, +42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability +where the compilation of the table.fill instruction can result in +a host panic. This means that a valid guest can be compiled with +Winch, on any architecture, and cause the host to panic. This +represents a denial-of-service vulnerability in Wasmtime due to +guests being able to trigger a panic. The specific issue is that +a historical refactoring changed how compiled code referenced tables +within the table.* instructions. This refactoring forgot to update +the Winch code paths associated as well, meaning that Winch was +using the wrong indexing scheme. Due to the feature support of +Winch the only problem that can result is tables being mixed up or +nonexistent tables being used, meaning that the guest is limited +to panicking the host (using a nonexistent table), or executing +spec-incorrect behavior and modifying the wrong table. This +vulnerability is fixed in crate versions: 36.0.7, 42.0.2, and 43.0.1.
+