Live › vulnerability › CVE-2026-121439
Wasmtime, the WebAssembly runtime, accepts unvalidated content-length headers from wasip3 guest programs in its wasi-http implementation. A malicious guest can splice an existing body into a new response, enabling response splitting or injection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Only deployments running Wasmtime 46.0.0 to 48.0.6 or 49.0.0 to 49.0.3 that execute wasip3 guests using the wasi-http interface are exposed. Hosts that run only trusted guests, or that do not use wasi-http p3, have a much smaller exposure.
No product ranges from the sources yet.
wasmtime --version or the wasmtime crate version in Cargo.lock46.x before 48.0.7: move to 48.0.7 or later49.x before 49.0.4: move to or later49.0.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-121439")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.