PkgSeer

Vulnerability RUSTSEC-2026-0375

Medium Risk

1 day ago

`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies

46.0.0 - 48.0.6 and 49.0.0 - 49.0.3

Summary

`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies

Details

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc For more information see the GitHub-hosted security advisory.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

`wasi-http`: Guests can add conflicting content lengths to messages

9.0.0 - 36.0.18 and 37.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0376

`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook

46.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0377

Guests can send absolute-form HTTP requests to different hosts

9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0350

`wasi-http`: Request with long url before query parameter crashes host

46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0351

Wasmtime wasi:http implementation panics with a zero timeout supplied

46.0.0 - 48.0.3 and 49.0.0 - 49.0.1 RUSTSEC-2026-0320

View all vulnerabilities for these packages

Impacted packages

wasmtime-wasi-http

Timeline

Published

1 day ago

Fixed (49.0.4)

21 hours ago

Fixed (48.0.7)

21 hours ago

Last Modified

5 hours ago