CVE-2026-121440 Details
Description
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
A vulnerability exists in Wasmtime versions 46.0.0 prior to 48.0.7 and 49.0.0 prior to 49.0.4, where forwarded trailers in HTTP responses are not properly checked against the embedder-customized `WasiHttpHooks::is_forbidden_header` hook. This oversight allows WASIp3 guests to forward request or response bodies in a way that bypasses intended header restrictions, potentially undermining the embedder's requirements for trailer headers.
Users can upgrade to Wasmtime versions 48.0.7 or 49.0.4, where this vulnerability has been patched. Embedders that customized the `is_forbidden_header` hook must update their implementations to use the new `forbidden_header_filter` method to fully address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-424 | Improper Protection of Alternate Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 46.0.0, < 48.0.7 (semver) >= 49.0.0, < 49.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |