Denial of Service Vulnerability in Wasmtime Affected by Long Request URLs

CVE-2026-119131

What is CVE-2026-119131?

A vulnerability exists in the Wasmtime runtime versions prior to 48.0.6 and 49.0.3, specifically within the wasmtime-wasi-http component. This vulnerability allows malicious guests to exploit the system by sending excessively long request URLs. By leveraging the set-path-with-query method, attackers can append a '?' character after 65535 bytes, resulting in an overflow of a u16 index in the http crate which ultimately causes a host panic. This can lead to a denial of service, rendering the host unable to process additional requests.

References