Skip to content

← Public intelligence

crates.io package

wasmtime-wasi-http

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.7crates.ioPublished

    wasi-http p2: outgoing content-length can be invalid or not match body

    GHSA-h4wp-g4x3-7398

    Affected
    • crates.io wasmtime-wasi-http >= 0.0.0-0, < 36.0.20; >= 37.0.0, < 48.0.8; >= 49.0.0, < 49.0.5; >= 50.0.0, < 50.0.1
    Fixed in
    50.0.136.0.2049.0.548.0.8· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398 For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 50.0.1, 49.0.5, 48.0.8 or 36.0.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  2. Low, CVSS 3.7crates.ioAmendedPublished

    wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hook

    CVE-2026-121440 · GHSA-jxcf-8qw5-5c33

    Affected
    • crates.io wasmtime-wasi-http >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4
    Fixed in
    49.0.448.0.7· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33 For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.4 or 48.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  3. Low, CVSS 3.7crates.ioAmendedPublished

    wasi-http: Guests can add conflicting content lengths to messages

    CVE-2026-121441 · GHSA-r8xh-cgf7-392j

    Affected
    • crates.io wasmtime-wasi-http >= 0.0.0-0, < 36.0.19; >= 37.0.0, < 48.0.7; >= 49.0.0, < 49.0.4
    Fixed in
    49.0.448.0.736.0.19· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.4, 48.0.7 or 36.0.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  4. Medium, CVSS 5.3crates.ioAmendedPublished

    wasi-http p3: Guests can set incorrect content-length for spliced response bodies

    CVE-2026-121439 · GHSA-9prg-84vf-g5fc

    Affected
    • crates.io wasmtime-wasi-http >= 46.0.0, < 48.0.7; >= 49.0.0, < 49.0.4
    Fixed in
    49.0.448.0.7· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.4 or 48.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  5. Low, CVSS 2.1crates.ioAmendedPublished

    Guests can send absolute-form HTTP requests to different hosts

    CVE-2026-119130 · GHSA-5qpp-g3j2-8frx

    Affected
    • crates.io wasmtime-wasi-http >= 0.0.0-0, < 36.0.18; >= 37.0.0, < 48.0.6; >= 49.0.0, < 49.0.3
    Fixed in
    48.0.649.0.336.0.18· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.3, 48.0.6 or 36.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  6. Medium, CVSS 5.3crates.ioAmendedPublished

    wasi-http: Request with long url before query parameter crashes host

    CVE-2026-119131 · GHSA-w36r-2hch-9xp9

    Affected
    • crates.io wasmtime-wasi-http >= 46.0.0, < 48.0.6; >= 49.0.0, < 49.0.3
    Fixed in
    48.0.649.0.3· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9 For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.3 or 48.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  7. Medium, CVSS 5.9crates.ioAmendedPublished

    Wasmtime wasi:http implementation panics with a zero timeout supplied

    CVE-2026-115382 · GHSA-w4qr-p94g-mjhv

    Affected
    • crates.io wasmtime-wasi-http >= 46.0.0, < 48.0.4; >= 49.0.0, < 49.0.2
    Fixed in
    48.0.449.0.2· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.2 or 48.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  8. Medium, CVSS 6.2crates.ioPublished

    Outgoing HTTP body write allows guest-driven host memory exhaustion

    CVE-2026-115388 · GHSA-c9gc-w9vx-w86p

    Affected
    • crates.io wasmtime-wasi-http >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1
    Fixed in
    36.0.1648.0.349.0.1· Vendor fix available
    Issue
    This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory.

    Recommended action: Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →