Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-119130

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bytecodealliance wasmtime

Default version status: unaffected

  • 0 to < 36.0.18affected
  • 36.0.18unaffected
  • 37.0.0 to < 48.0.6affected
  • 48.0.6unaffected
  • 49.0.0 to < 49.0.3affected
  • 49.0.3unaffected
pkg:cargo/wasmtime-wasi-http

References