Request Smuggling Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-121441

6.3MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121441?

Wasmtime exhibits a vulnerability in its wasi-http implementation that allows malicious guests to send HTTP requests with conflicting content-length headers. This exploitation can lead to request smuggling, bypassing server filters, and causing potential disruptions or data breaches. It is essential for users running the vulnerable versions to upgrade to the patched releases to mitigate these risks.

Affected Version(s)

wasmtime 0 < 36.0.19

wasmtime 37.0.0 < 48.0.7

wasmtime 49.0.0 < 49.0.4

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-before-36.0...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.