{"record":{"id":"2491e28dbe65620b","repo":"crowdsecurity/crowdsec","slug":"goarch-s-has-no-wasm-compiler-backend","errorCode":null,"errorMessage":"GOARCH %s has no wasm compiler backend","messagePattern":"GOARCH (.+?) has no wasm compiler backend","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/appsec/challenge/challenge.go","lineNumber":356,"sourceCode":"\treturn compiledMod, nil\n}\n\n// compilerSupported mimics the check performed by wazero for SSE4.1\n// We cannot rely in wazero on the wazero check, as it is used to choose whether to use the compiler or interpreter mode\n// If we force the compiler mode, and it's not supported, we will crash with SIGILL on the 1st instruction.\n// Compiler mode is required as interpreter mode is way too slow for the obfuscation (measured as being at least 60 times slower)\nfunc compilerSupported() error {\n\tswitch runtime.GOARCH {\n\tcase \"arm64\":\n\t\treturn nil\n\tcase \"amd64\":\n\t\tif !cpu.X86.HasSSE41 {\n\t\t\treturn errors.New(\"CPU lacks SSE4.1\")\n\t\t}\n\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"GOARCH %s has no wasm compiler backend\", runtime.GOARCH)\n\t}\n}\n\nfunc newWazeroRuntime(ctx context.Context) (wazero.Runtime, error) {\n\tif err := compilerSupported(); err != nil {\n\t\treturn nil, fmt.Errorf(\"wasm compiler mode unavailable: %w\", err)\n\t}\n\n\tvar r wazero.Runtime\n\tvar err error\n\n\tfunc() {\n\t\t// wazero checks for executable memory, and panics if it cannot allocat it.\n\t\t// Catch the panic and return an error instead, so we can provide a more helpful message to the user.\n\t\tdefer func() {\n\t\t\tif rec := recover(); rec != nil {\n\t\t\t\terr = fmt.Errorf(\"failed to create wasm runtime in compiler mode: %v \"+\n\t\t\t\t\t\"(the kernel likely denied an executable memory mapping: check W^X hardening, seccomp or SELinux policy)\", rec)","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/challenge.go#L338-L374","documentation":"compilerSupported rejects architectures for which wazero's compiler backend does not exist in this build (it explicitly checks amd64 SSE4.1 and falls back to an error for other GOARCH values). newWazeroRuntime wraps it as 'wasm compiler mode unavailable'. The AppSec challenge runtime cannot start in compiler mode on this platform.","triggerScenarios":"Building/running on GOARCH other than amd64/arm64 (e.g. 386, arm, riscv64) where newWazeroRuntime calls compilerSupported and hits the default case.","commonSituations":"Running crowdsec on 32-bit ARM boards (Raspberry Pi OS armv6/armv7), i386 builds, or unusual architectures; building with GOARCH overrides for embedded devices.","solutions":["Run on a supported architecture: linux/amd64 (with SSE4.1) or arm64.","Check your CPU supports SSE4.1 on amd64: grep sse4_1 /proc/cpuinfo.","Use an official crowdsec build for your platform rather than a self-compiled cross-build.","If you must run on an unsupported arch, raise an upstream issue to add an interpreter-mode fallback."],"exampleFix":"// before\nGOOS=linux GOARCH=386 go build ./cmd/crowdsec\n// after\nGOOS=linux GOARCH=amd64 go build ./cmd/crowdsec","handlingStrategy":"validation","validationCode":"// Guard before initializing AppSec challenge support\nif runtime.GOARCH != \"amd64\" && runtime.GOARCH != \"arm64\" {\n    // challenge runtime compiler backend unavailable; disable appsec or use interpreter mode\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deploy only official builds for amd64/arm64","Document arch requirements in your deployment manifests","Check runtime.GOARCH in startup scripts before enabling appsec"],"tags":["go","wasm","architecture","platform-support"],"backgroundTag":"unsupported-platform","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}