CVE-2026-121441 Details
Description
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.
A request smuggling vulnerability has been identified in Wasmtime versions prior to 36.0.19, 37.0.0 prior to 48.0.7, and 49.0.0 prior to 49.0.4. This vulnerability resides in the wasi-http component, where guests can set multiple conflicting content-length headers. Malicious guests may exploit this by causing the host to send HTTP requests with inconsistent content-length values, potentially bypassing servers or intermediaries that do not properly handle such conflicts.
Users can upgrade to Wasmtime versions 36.0.19, 48.0.7, or 49.0.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bytecode Alliance Wasmtime | < 36.0.19 (semver) >= 37.0.0, < 48.0.7 (semver) >= 49.0.0, < 49.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |