CVE-2026-121441

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions 37.0.0 through 48.0.6 Wasmtime versions 49.0.0 through 49.0.3

Description A request smuggling issue exists in the wasi-http component. This allows guests to specify multiple conflicting content-length headers, which can lead the host to transmit HTTP requests with inconsistent length values. This behavior can be exploited to smuggle requests through servers or intermediaries that fail to reject such conflicting headers.

Recommendations Update Wasmtime to version 36.0.19 or later. Update Wasmtime to version 48.0.7 or later. Update Wasmtime to version 49.0.4 or later.