Vulnerability RUSTSEC-2026-0351
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
17 hours ago
October 14, 2026 at 12:00 PM UTC
`wasi-http`: Request with long url before query parameter crashes host
46.0.0 - 48.0.5 and 49.0.0 - 49.0.2
46.0.0 - 48.0.5 and 49.0.0 - 49.0.2
Summary
`wasi-http`: Request with long url before query parameter crashes host
Details
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9 For more information see the GitHub-hosted security advisory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
17 hours ago
Guests can send absolute-form HTTP requests to different hosts
9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0350
9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0350
Unknown
12 days ago
Wasmtime wasi:http implementation panics with a zero timeout supplied
46.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0320
46.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0320
Medium Risk
20 days ago
Outgoing HTTP body write allows guest-driven host memory exhaustion
9.0.0 - 36.0.15 and 37.0.0 - 48.0.2 and 49.0.0 RUSTSEC-2026-0313
9.0.0 - 36.0.15 and 37.0.0 - 48.0.2 and 49.0.0 RUSTSEC-2026-0313
Impacted packages
Timeline
Published
17 hours ago
October 14, 2026 at 12:00 PM UTC
Fixed (48.0.6)
12 hours ago
October 14, 2026 at 04:59 PM UTC
Fixed (49.0.3)
12 hours ago
October 14, 2026 at 05:11 PM UTC
Last Modified
8 hours ago
October 14, 2026 at 08:30 PM UTC