{"record":{"id":"679df28ef2d52589","repo":"crowdsecurity/crowdsec","slug":"wasm-compiler-mode-unavailable-w","errorCode":null,"errorMessage":"wasm compiler mode unavailable: %w","messagePattern":"wasm compiler mode unavailable: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/appsec/challenge/challenge.go","lineNumber":362,"sourceCode":"// Compiler mode is required as interpreter mode is way too slow for the obfuscation (measured as being at least 60 times slower)\nfunc compilerSupported() error {\n\tswitch runtime.GOARCH {\n\tcase \"arm64\":\n\t\treturn nil\n\tcase \"amd64\":\n\t\tif !cpu.X86.HasSSE41 {\n\t\t\treturn errors.New(\"CPU lacks SSE4.1\")\n\t\t}\n\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"GOARCH %s has no wasm compiler backend\", runtime.GOARCH)\n\t}\n}\n\nfunc newWazeroRuntime(ctx context.Context) (wazero.Runtime, error) {\n\tif err := compilerSupported(); err != nil {\n\t\treturn nil, fmt.Errorf(\"wasm compiler mode unavailable: %w\", err)\n\t}\n\n\tvar r wazero.Runtime\n\tvar err error\n\n\tfunc() {\n\t\t// wazero checks for executable memory, and panics if it cannot allocat it.\n\t\t// Catch the panic and return an error instead, so we can provide a more helpful message to the user.\n\t\tdefer func() {\n\t\t\tif rec := recover(); rec != nil {\n\t\t\t\terr = fmt.Errorf(\"failed to create wasm runtime in compiler mode: %v \"+\n\t\t\t\t\t\"(the kernel likely denied an executable memory mapping: check W^X hardening, seccomp or SELinux policy)\", rec)\n\t\t\t}\n\t\t}()\n\n\t\tr = wazero.NewRuntimeWithConfig(ctx, wazero.NewRuntimeConfigCompiler())\n\t}()\n","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/challenge.go#L344-L380","documentation":"newWazeroRuntime wraps any compilerSupported() failure with this message, meaning the wazero compiler backend cannot run here: unsupported GOARCH, or amd64 CPU lacking SSE4.1. AppSec challenge runtime initialization aborts because compiler mode is requested.","triggerScenarios":"NewChallengeRuntime -> newWazeroRuntime -> compilerSupported returns an error (GOARCH without a wazero compiler backend, or x86-64 CPU without SSE4.1).","commonSituations":"Old x86-64 CPUs/pre-2009 virtual hosts without SSE4.1; 32-bit or other non-amd64/arm64 builds; VMs or emulators (e.g. QEMU without SSE4.1 passthrough).","solutions":["Run on hardware supporting SSE4.1 (check: grep -q sse4_1 /proc/cpuinfo) or move to arm64.","Rebuild for a supported GOARCH (amd64/arm64).","If running in a VM/emulator, enable a CPU model that exposes SSE4.1 (e.g. QEMU -cpu host or Nehalem+).","Ask maintainers about an interpreter-mode (wazero.NewRuntimeConfigInterpreter) fallback for unsupported hosts."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// amd64: require SSE4.1 before installing\nif runtime.GOOS == \"linux\" && runtime.GOARCH == \"amd64\" && !cpu.X86.HasSSE41 {\n    fmt.Println(\"CPU lacks SSE4.1: appsec challenge runtime unavailable\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify host CPU flags (sse4_1) in preflight/health checks","Configure VM CPU models that expose SSE4.1 (QEMU -cpu host)","Pin deployment targets to supported architectures"],"tags":["go","wasm","wazero","cpu-compatibility"],"backgroundTag":"unsupported-platform","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}