CVE-2026-119130 json
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
published 2026-10-14 26 d ago modified 2026-10-30 10 d ago also EUVD-2026-113197 , GHSA-5qpp-g3j2-8frx , RUSTSEC-2026-0350
- cvss
- 2.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.
Patch / fix
- crates.io wasmtime-wasi-http 36.0.18, 48.0.6, 49.0.3
- bytecodealliance wasmtime 36.0.18, 48.0.6, 49.0.3
- rust-wasmtime Debian 14 36.0.20+dfsg-1
debian advisories DEBIAN-CVE-2026-119130
- github.com/bytecodealliance/wasmtime#14727 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime-wasi-http | >=0.0.0-0, <36.0.18 >=37.0.0, <48.0.6 >=49.0.0, <49.0.3 |
36.0.18 48.0.6 49.0.3 |
Affected products
- bytecodealliance wasmtime
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/bytecodealliance/wasmtime/pull/14727
web
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx
vendor-advisory
-
vulncheck.com
/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smugglin
third-party-advisory
-
crates.io
/crates/wasmtime-wasi-http
package
-
rustsec.org
/advisories/RUSTSEC-2026-0350.html
advisory
Sources
- CVE List CVE-2026-119130
- NVD CVE-2026-119130
- OSV RUSTSEC-2026-0350
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.