Header Filtering Bypass in Wasmtime by Bytecode Alliance
CVE-2026-121440

6.3MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121440?

The vulnerability in Wasmtime versions prior to 48.0.7 and 49.0.4 arises from inadequate validation of forwarded trailers via the WasiHttpHooks::is_forbidden_header hook. This flaw allows WASIp3 guests to manipulate request or response bodies, leading to a scenario where embedder-customized header restrictions could be circumvented. Such behavior compromises the intended security model set by the embedder, making it vital for users to upgrade to secure versions to mitigate potential risks.

Affected Version(s)

wasmtime 46.0.0 < 48.0.7

wasmtime 49.0.0 < 49.0.4

wasmtime 48.0.7

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-befo...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.