Vulnerability · Published Oct 29, 2026 · Assigned by VulnCheck
CVE-2026-119130Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
Low 2.6
In plain English
A low-severity improper input validation in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-wasmtime | no fix listed | DEBIAN-CVE-2026-119130 |
| Debian:14 | rust-wasmtime | 36.0.20+dfsg-1 | DEBIAN-CVE-2026-119130 |
| Ubuntu:24.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-119130 |
| Ubuntu:26.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-119130 |
| Ubuntu:26.10 | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-119130 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bytecodealliance | wasmtime | 0 – before 36.0.1837.0.0 – before 48.0.649.0.0 – before 49.0.3 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N