CVE-2026-121441GHSA-r8xh-cgf7-392jRUSTSEC-2026-0376
wasi-http: Guests can add conflicting content lengths to messagesWasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| wasmtime-wasi-httpcrates.io | >= 0.0.0-0, < 36.0.19>= 37.0.0, < 48.0.7>= 49.0.0, < 49.0.4 | 36.0.1948.0.749.0.4 | OSV |
0.2%13th percentile
Bar shows rank among all scored CVEs.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security