Vulnerability RUSTSEC-2026-0350
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
17 hours ago
October 14, 2026 at 12:00 PM UTC
Guests can send absolute-form HTTP requests to different hosts
9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2
9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2
Summary
Guests can send absolute-form HTTP requests to different hosts
Details
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
17 hours ago
`wasi-http`: Request with long url before query parameter crashes host
46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0351
46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0351
Unknown
12 days ago
Wasmtime wasi:http implementation panics with a zero timeout supplied
46.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0320
46.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0320
Medium Risk
20 days ago
Outgoing HTTP body write allows guest-driven host memory exhaustion
9.0.0 - 36.0.15 and 37.0.0 - 48.0.2 and 49.0.0 RUSTSEC-2026-0313
9.0.0 - 36.0.15 and 37.0.0 - 48.0.2 and 49.0.0 RUSTSEC-2026-0313
Impacted packages
Timeline
Published
17 hours ago
October 14, 2026 at 12:00 PM UTC
Fixed (36.0.18)
13 hours ago
October 14, 2026 at 03:36 PM UTC
Fixed (48.0.6)
12 hours ago
October 14, 2026 at 04:59 PM UTC
Fixed (49.0.3)
12 hours ago
October 14, 2026 at 05:11 PM UTC
Last Modified
8 hours ago
October 14, 2026 at 08:30 PM UTC