CVE-2026-126406

The wasmtime-wasi-http p2 implementation in Wasmtime is vulnerable to HTTP Request Smuggling . Affected versions include prior to 36.0.20 , 37.0.0 before 48.0.8 , 49.0.0 before 49.0.5 , and 50.0.0 before 50.0.1 . The root cause is the ability of the component to send outgoing requests with confli...

EUVD-2026-125159

The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a received response's headers resource to...

CVE-2026-121441

A flaw was found in Wasmtime's wasi-http component. A malicious WebAssembly Wasm guest application can set multiple conflicting Content-Length headers on outgoing HTTP requests. This flaw allows an attacker to perform HTTP request smuggling through downstream servers or intermediaries that do not...

CVE-2026-121439

A flaw was found in wasmtime. The wasi-http component fails to properly validate Content-Length headers when processing network responses. A malicious WebAssembly guest can supply an invalid Content-Length header and splice response bodies, allowing HTTP Hypertext Transfer Protocol response...

CVE-2026-121441

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to...

CVE-2026-121440

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header...

CVE-2026-121439

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform...

CVE-2026-121441

Wasmtime versions before 36.0.19 , 37.0.0 before 48.0.7 , and 49.0.0 before 49.0.4 are vulnerable to a request smuggling vulnerability in the wasi-http component. The root cause is that guests can set multiple conflicting content-length headers , which may lead the host to send HTTP requests with...

CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header...

CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to...

CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header...

CVE-2026-121440

The Wasmtime runtime versions 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contain a vulnerability where they fail to validate forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3 . This allows WASIp3 guests to forward request or response bodies, causing their t...

EUVD-2026-115862

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header...

CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to...

EUVD-2026-115863

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to...

CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to...

CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::isforbiddenheader hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header...

CVE-2026-121439

Wasmtime versions 46.0.0 (before 48.0.7) and 49.0.0 (before 49.0.4) are vulnerable to an HTTP Response Splitting vulnerability within the wasi-http p3 component. The root cause is that guests can set unvalidated content-length headers . This allows malicious wasip3 guests to splice an existing bo...

CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform...

CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform...