Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: bytecodealliance wasmtime 48.0.7, 49.0.4 Clear all filters
TI-2026-84322 CVE-2026-121440 · GHSA-j86m-34pm-p9mv

Wasmtime forwarded trailers skip forbidden header filtering

Priority LOW 27

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00224 Published 2026-11-03 Partial fix · 48.0.7, 49.0.4 CWE-424
TI-2026-84321 CVE-2026-121439 · GHSA-4v2q-64x5-xvrc

Wasmtime HTTP Response Splitting via wasi-http

Priority LOW 30

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00193 Published 2026-11-03 Partial fix · 48.0.7, 49.0.4 CWE-444