bytecodealliance wasmtime up to 36.0.18/48.0.6/49.0.3 wasi-http request smuggling

Summaryinfo

A vulnerability has been found in bytecodealliance wasmtime up to 36.0.18/48.0.6/49.0.3 and classified as problematic. Affected is an unknown function of the component wasi-http. This manipulation causes request smuggling. This vulnerability appears as CVE-2026-121441. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in bytecodealliance wasmtime up to 36.0.18/48.0.6/49.0.3. Affected by this vulnerability is an unknown part of the component wasi-http. The manipulation with an unknown input leads to a request smuggling vulnerability. The CWE definition for the vulnerability is CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. As an impact it is known to affect integrity. The summary by CVE is:

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-121441 since 11/03/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 36.0.19, 48.0.7 or 49.0.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• bytecodealliance

Name

• wasmtime

Version

• 36.0.0
• 36.0.1
• 36.0.2
• 36.0.3
• 36.0.4
• 36.0.5
• 36.0.6
• 36.0.7
• 36.0.8
• 36.0.9
• 36.0.10
• 36.0.11
• 36.0.12
• 36.0.13
• 36.0.14
• 36.0.15
• 36.0.16
• 36.0.17
• 36.0.18
• 48.0.0
• 48.0.1
• 48.0.2
• 48.0.3
• 48.0.4
• 48.0.5
• 48.0.6
• 49.0.0
• 49.0.1
• 49.0.2
• 49.0.3

Website

• Product: https://github.com/bytecodealliance/wasmtime/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion