CVE-2026-121439

Wasmtime versions 46.0.0 (before 48.0.7) and 49.0.0 (before 49.0.4) are vulnerable to an HTTP Response Splitting vulnerability within the wasi-http p3 component. The root cause is that guests can set unvalidated content-length headers . This allows malicious wasip3 guests to splice an existing bo...