CVE-2026-119131 Details
Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.
A denial-of-service vulnerability has been identified in Wasmtime versions 46.0.0 prior to 48.0.6 and 49.0.0 prior to 49.0.3. The issue resides in the wasmtime-wasi-http component, where guests can cause a host panic by sending long request URLs. This is achieved by using the set-path-with-query function to include a '?' after byte 65535, which overflows a u16 index in the http crate, leading to a crash on the host.
Users can upgrade to Wasmtime versions 48.0.6 or 49.0.3, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 46.0.0, < 48.0.6 (semver) >= 49.0.0, < 49.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |