CVE-2026-121439

Name of the Vulnerable Software and Affected Versions Wasmtime versions 46.0.0 through 48.0.6 Wasmtime versions 49.0.0 through 49.0.3

Description A response splitting issue exists in the wasi-http p3 component. This allows guests to set unvalidated content-length headers, enabling malicious wasip3 guests to splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.

Recommendations Update Wasmtime versions 46.0.0 through 48.0.6 to version 48.0.7. Update Wasmtime versions 49.0.0 through 49.0.3 to version 49.0.4.