Live › vulnerability › CVE-2026-121441
Wasmtime's wasi-http layer accepts multiple conflicting content-length headers from a guest module. An attacker running code inside a guest can make the host send requests that servers or proxies may read differently, enabling request smuggling.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that embed Wasmtime and run untrusted or semi-trusted guest modules that make outgoing HTTP requests through wasi-http. Exposure depends on whether guests can set headers and whether a downstream server or proxy accepts conflicting content-length values. Deployments that run only trusted guests or do not use wasi-http are less exposed.
No product ranges from the sources yet.
wasmtime --version or the wasmtime crate version in Cargo.lock36.0.19 for the 36 line48.0.7 for the 48 line49.0.4 for the 49 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.
This page as .md · .json · in your agent: get_signal("CVE-2026-121441")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.