Live › vulnerability › CVE-2026-119131
Wasmtime's wasmtime-wasi-http component mishandles request URLs with a '?' after byte 65535 because of a u16 index overflow in the http crate. A guest module can send such a URL and crash the host process with a panic, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only hosts running Wasmtime 46.0.0 before 48.0.6 or 49.0.0 before 49.0.3 with wasmtime-wasi-http, which lets untrusted guest code send HTTP requests. Teams that only run trusted guests or do not use the wasi-http feature can deprioritise it.
No product ranges from the sources yet.
cargo tree -i wasmtime or the lockfile.48.0.6 for the 48 line.49.0.3 for the 49 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.
This page as .md · .json · in your agent: get_signal("CVE-2026-119131")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.