Vulnerability RUSTSEC-2026-0421
Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
1 day ago
October 29, 2026 at 12:00 PM UTC
wasi-http p2: outgoing content-length can be invalid or not match body
9.0.0 - 36.0.19 and 37.0.0 - 48.0.7 and 49.0.0 - 49.0.4 and 50.0.0
9.0.0 - 36.0.19 and 37.0.0 - 48.0.7 and 49.0.0 - 49.0.4 and 50.0.0
Summary
wasi-http p2: outgoing content-length can be invalid or not match body
Details
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398 For more information see the GitHub-hosted security advisory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
11 days ago
`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
46.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0375
46.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0375
Low Risk
11 days ago
`wasi-http`: Guests can add conflicting content lengths to messages
9.0.0 - 36.0.18 and 37.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0376
9.0.0 - 36.0.18 and 37.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0376
Low Risk
11 days ago
`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
46.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0377
46.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0377
Unknown
16 days ago
Guests can send absolute-form HTTP requests to different hosts
9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0350
9.0.0 - 36.0.17 and 37.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0350
Medium Risk
16 days ago
`wasi-http`: Request with long url before query parameter crashes host
46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0351
46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0351
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 12:00 PM UTC
Fixed (36.0.20)
1 day ago
October 29, 2026 at 05:40 PM UTC
Fixed (50.0.1)
1 day ago
October 29, 2026 at 05:49 PM UTC
Fixed (49.0.5)
1 day ago
October 29, 2026 at 06:12 PM UTC
Fixed (48.0.8)
1 day ago
October 29, 2026 at 06:34 PM UTC
Last Modified
17 hours ago
October 30, 2026 at 10:45 AM UTC