CVE-2026-119130
Deferred Deferred - Pending Action

HTTP Request Smuggling in Wasmtime

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119130
EUVD
EUVD-2026-113197

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
bytecodealliance wasmtime 0
bytecodealliance wasmtime 37.0.0
bytecodealliance wasmtime 49.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an HTTP Request Target Smuggling issue in Wasmtime versions before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3. It occurs because Wasmtime does not validate that set-path-with-query values in wasmtime-wasi-http are valid paths. This allows absolute-form URLs to be written directly as the HTTP/1.1 request target, bypassing embedder filtering policies. A malicious guest can exploit this to send requests to disallowed hosts through a forward proxy or gateway that honors the absolute URL.

Impact Analysis

The impact is limited due to the vulnerability's low severity. Exploitation requires network access, high attack complexity, and low privileges. It does not directly affect the confidentiality, integrity, or availability of the vulnerable system. However, a malicious guest could potentially bypass host restrictions and send requests to unintended hosts through a forward proxy or gateway.

Mitigation Strategies

Update Wasmtime to patched versions 36.0.18, 48.0.6, or 49.0.3 or later to address the vulnerability. Review and enforce strict input validation for HTTP request targets in wasmtime-wasi-http to prevent absolute-form URLs from bypassing host restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart