CVE-2026-126406
Deferred Deferred - Pending Action

HTTP Request Smuggling in Wasmtime

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a received response's headers resource to send a bodyless request can enable request smuggling against non-compliant servers, potentially bypassing embedder destination access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126406
EUVD
EUVD-2026-125159

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wasmtime wasmtime to 36.0.20 (exc)
wasmtime wasmtime From 37.0.0 (inc) to 48.0.8 (exc)
wasmtime wasmtime From 49.0.0 (inc) to 49.0.5 (exc)
wasmtime wasmtime From 50.0.0 (inc) to 50.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the wasmtime-wasi-http p2 implementation in Wasmtime versions before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1. It allows sending conflicting or mismatched content-length headers in outgoing requests. A guest can reuse a received response's headers to send a bodyless request, enabling request smuggling against non-compliant servers and potentially bypassing access controls.

Impact Analysis

This vulnerability could allow attackers to smuggle requests, bypass security controls, or access unauthorized resources. It may lead to data breaches, unauthorized actions, or service disruption if exploited against vulnerable servers.

Mitigation Strategies

Update Wasmtime to a patched version (36.0.20, 48.0.8, 49.0.5, or 50.0.1 or later) to address the conflicting content-length header issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...