PT-2026-136197

CVE-2026-121440

·

Published

2026-11-03

·

Updated

2026-11-03

Description by

CVSS 3.1
3.7
Low
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is forbidden header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-424: Improper Protection of Alternate Path
Related identifiers
CVE-2026-121440
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com