CVE-2026-121439 in Wasmtime
Summary
by MITRE • 11/03/2026
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The identified vulnerability resides within the WASI HTTP implementation of Wasmtime, specifically affecting versions 46.0.0 through 48.0.7 and version 49.0.0 prior to patch release 49.0.4. This security flaw is classified as a response splitting or header injection vulnerability that stems from insufficient validation of HTTP headers provided by WebAssembly guests operating under the WASI-P3 interface. In modern web architectures, particularly those utilizing server-side rendering or API gateways where WebAssembly modules act as intermediaries or handlers, the integrity of HTTP responses is critical for preventing client-side attacks and ensuring data consistency. The core technical flaw allows a malicious guest to manipulate the Content-Length header without proper sanitization or validation against the actual body content being transmitted.
From an operational perspective, this lack of validation enables attackers to splice existing response bodies into new responses while specifying an incorrect Content-Length value. This discrepancy between the declared length and the actual data payload can lead to HTTP request smuggling scenarios if the vulnerable component is situated behind a reverse proxy or load balancer that relies on these headers for routing decisions. Furthermore, it facilitates injection attacks where malicious content can be embedded within the response stream, potentially leading to Cross-Site Scripting (XSS) or cache poisoning depending on how downstream systems process the malformed responses. The ability to split responses effectively breaks the atomicity of HTTP transactions, allowing an attacker to inject arbitrary headers or body segments that may bypass security controls such as Content Security Policies or input validation filters implemented at higher layers.
This vulnerability aligns with CWE-113, which describes Improper Neutralization of CRLF Sequences in HTTP Headers, and CWE-20, which covers Improper Input Validation regarding the structural integrity of transmitted data. In terms of adversarial tactics, this behavior corresponds to MITRE ATT&CK techniques related to Injection and potentially Request Smuggling if exploited within proxied environments. The exploitation vector requires a malicious WebAssembly module with access to the WASI-P3 HTTP interface, which implies that any application deploying untrusted or third-party Wasm modules is at risk unless strict sandboxing policies are enforced.
Mitigation strategies primarily involve upgrading Wasmtime to version 48.0.7 or later for the older branch and version 49.0.4 or later for the newer branch, as these releases include patches that enforce stricter validation on HTTP headers generated by guests. Additionally, developers should implement defense-in-depth measures such as validating Content-Length values against actual body sizes within their own application logic before forwarding responses to clients. Utilizing web application firewalls configured to detect anomalies in header-body mismatches can also provide an additional layer of protection. It is crucial for organizations relying on Wasmtime for high-performance server-side workloads to audit their dependency versions and ensure that all WebAssembly modules are sourced from trusted repositories with rigorous security reviews to prevent the introduction of malicious guests capable of exploiting this flaw.