CVE-2021-43790

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Nov 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-437915.3Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration datCVE-2021-437924.3Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visiCVE-2021-437934.3Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple tiCVE-2021-437945.3Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) usCVE-2021-437957.5Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond iCVE-2021-437976.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2021-437987.5Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versionsCVE-2021-437999.8Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prCVE-2021-43809.8The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_autCVE-2021-438007.5Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage CVE-2021-438017.5Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sendingCVE-2021-438028.8Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, m
CVE-2021-43790: High severity, CVSS 8.1 | Vulnix