Description
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bytecodealliance | wasmtime | < 36.0.19, 37.0.0 – < 48.0.7, 49.0.0 – < 49.0.4 | 36.0.19 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | wasmtime-wasi-http | >= 0.0.0-0, < 36.0.19 · >= 37.0.0, < 48.0.7 · >= 49.0.0, < 49.0.4 | 36.0.19, 48.0.7, 49.0.4 | RUSTSEC-2026-0376 |