CVE-2026-121439
Deferred Deferred - Pending Action

Response Splitting in Wasmtime WASI-HTTP p3

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121439
EUVD
EUVD-2026-115861

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bytecodealliance wasmtime 46.0.0
bytecodealliance wasmtime 49.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an HTTP response splitting issue in Wasmtime versions 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3. Malicious WebAssembly guests can manipulate the content-length header without validation, allowing them to inject or split HTTP responses. This occurs in the wasi-http component when splicing an existing body into a new response with an incorrect content-length.

Detection Guidance

To detect this vulnerability, check the version of Wasmtime installed on your system. Run: wasmtime --version. If the version is between 46.0.0-48.0.6 or 49.0.0-49.0.3, the system is vulnerable. Additionally, inspect HTTP responses for malformed content-length headers or unexpected response splitting in logs.

Impact Analysis

This vulnerability allows attackers to perform response splitting or injection attacks. This could lead to cache poisoning, cross-site scripting (XSS), or other attacks that manipulate how users interact with web applications. Systems using affected Wasmtime versions for HTTP handling via wasi-http are at risk.

Mitigation Strategies

Immediately upgrade Wasmtime to version 48.0.7, 49.0.4, or a later version. If using the wasmtime-wasi-http package, ensure it is updated to a patched version. Disable or restrict use of wasi-http in affected versions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...