HTTP Request Target Smuggling Risk in Wasmtime by Bytecode Alliance

CVE-2026-119130

What is CVE-2026-119130?

Wasmtime, an open-source runtime for WebAssembly, contains a vulnerability that allows an attacker to provide malicious absolute-form URLs through the set-path-with-query values in the wasmtime-wasi-http module. Due to insufficient verification, these URLs are processed verbatim as the HTTP/1.1 request target. This exploitation could potentially bypass embedder filtering policies, allowing unauthorized access to disallowed hosts through forward proxies or gateways.

References