Skip to content
fr Sign in
6.3 Medium

CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…

Description

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.

Affected products and versions

Product Affected versions Fixed in
wasmtime 49.0 49.0.0 → < 49.0.4 49.0.4
wasmtime 48.0 earliest → < 48.0.7 48.0.7
wasmtime 46.0 46.0.0 → < 48.0.7 48.0.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of wasmtime

The 81 CVEs of wasmtime →
CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in… 6.3 Medium CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3… 6.9 Medium CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 5.9 Medium CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the… 5.9 Medium
Track this CVE