Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
bytecodealliance wasmtime
Default version status: unaffected
46.0.0 to < 48.0.6affected48.0.6unaffected49.0.0 to < 49.0.3affected49.0.3unaffected
pkg:cargo/wasmtime-wasi-http