CVE-2026-121440GHSA-jxcf-8qw5-5c33RUSTSEC-2026-0377
wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hookWasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| wasmtime-wasi-httpcrates.io | >= 46.0.0, < 48.0.7>= 49.0.0, < 49.0.4 | 48.0.749.0.4 | OSV |
0.2%13th percentile
Bar shows rank among all scored CVEs.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security