Response Splitting Vulnerability in Wasmtime by Bytecode Alliance

CVE-2026-121439

What is CVE-2026-121439?

The response splitting vulnerability in Wasmtime affects versions prior to 48.0.7 and 49.0.4. It allows malicious wasi-http guests to manipulate unvalidated content-length headers, enabling them to splice an existing body into new responses. This exploitation can lead to response splitting or injection attacks, posing significant security risks. Users are strongly advised to update their installations to mitigate these vulnerabilities and ensure secure operation.

References