CVE-2026-121441 in wasmtime
Summary
by MITRE • 11/03/2026
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The identified security flaw resides within the WebAssembly runtime environment, specifically affecting Wasmtime versions prior to 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4. This vulnerability is categorized as an HTTP request smuggling issue within the wasi-http subsystem, which provides WebAssembly modules with access to web-like networking capabilities. The core technical deficiency involves a failure in input validation regarding HTTP header processing, specifically concerning the Content-Length field. When a guest application invokes network operations through this interface, it retains the ability to inject or manipulate headers without sufficient sanitization by the host runtime. This lack of strict enforcement allows malicious guests to construct HTTP requests that contain multiple conflicting values for the Content-Length header. In standard HTTP protocol semantics, these fields should be mutually exclusive or consistent; however, the vulnerability permits their coexistence in a contradictory state within the same request stream.
The operational impact of this flaw is significant because it enables an attacker who controls a WebAssembly guest to manipulate how intermediate network devices and backend servers interpret incoming traffic. By sending requests with conflicting Content-Length headers, the malicious guest can exploit parsing discrepancies between different HTTP implementations. Some intermediaries may process the first header while others might prioritize the second, or they may attempt to parse both in ways that lead to ambiguous request boundaries. This ambiguity allows the attacker to smuggle arbitrary HTTP requests through firewalls, load balancers, or proxies that fail to reject such malformed traffic. The primary consequence is a bypass of security controls and access restrictions designed at these intermediate layers. An adversary could potentially inject administrative commands, exfiltrate sensitive data from internal services, or perform unauthorized actions on behalf of authenticated users by tricking the backend server into processing requests as if they originated from trusted sources.
From a classification perspective, this vulnerability aligns with CWE-436, which denotes Interpretation Conflict, and more specifically relates to HTTP Request Smuggling techniques documented in ATT&CK tactic T1589 (Credential Access) or T1071 (Application Layer Protocol). The root cause is fundamentally an input validation error where the runtime fails to enforce protocol compliance rules that are critical for maintaining request integrity. This type of flaw is particularly dangerous in cloud-native and serverless architectures where WebAssembly modules often act as microservices interacting with external APIs through shared network infrastructure. If left unpatched, this vulnerability could be leveraged in conjunction with other attacks to achieve remote code execution or data breach scenarios by manipulating the trust boundary between the guest environment and the host system's outbound connections.
Mitigation strategies must prioritize immediate software updates. Organizations running Wasmtime should upgrade to version 36.0.19, 48.0.7 for the 37.x branch, or 49.0.4 for the 49.x branch immediately upon availability. These releases contain patches that enforce strict validation of HTTP headers within the wasi-http implementation, ensuring that conflicting Content-Length values are rejected before they can be transmitted to upstream servers. In addition to patching, defense-in-depth measures should be implemented at the network perimeter. Security teams should configure web application firewalls and reverse proxies to detect and block requests containing duplicate or contradictory header fields. Furthermore, developers integrating WebAssembly modules into their applications should implement strict allow-lists for outbound connections and validate all HTTP responses received from external services to ensure that no unexpected side effects have occurred due to potential request manipulation. Regular security audits of the Wasmtime configuration and guest module code are also recommended to identify any other instances where header injection might be possible through alternative vectors within the runtime environment.