RUSTSEC-2026-0350 CVE-2026-119130 GHSA-5qpp-g3j2-8frx

Guests can send absolute-form HTTP requests to different hosts

Not rated yet crates.io

Severity: 0.0 / 10; Unknown · CVSS 4.0
Exploit chance (EPSS): 0.24%; Chance of exploitation in the next 30 days. Higher than 14.70% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 49.0.3; Upgrade wasmtime-wasi-http to this version or later

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory.

Affected versions

crates.io

Package	Vulnerable	Fixed in
wasmtime-wasi-http	`>= 0.0.0-0, < 36.0.18` `>= 37.0.0, < 48.0.6` `>= 49.0.0, < 49.0.3`	`36.0.18` `48.0.6` `49.0.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

wasmtime-wasi-http crates.io → `49.0.3`

cargo

cargo update -p wasmtime-wasi-http --precise 49.0.3

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: Low
User interaction: Passive
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0350.html

Packages

crates.io/crates/wasmtime-wasi-http

Timeline

Oct 14, 2026 Published
Oct 30, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
RUSTSEC-2026-0421 wasi-http p2: outgoing content-length can be invalid or not match body	Low	Also affects wasmtime-wasi-http
RUSTSEC-2026-0377 `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook	Low	Also affects wasmtime-wasi-http
RUSTSEC-2026-0376 `wasi-http`: Guests can add conflicting content lengths to messages	Low	Also affects wasmtime-wasi-http
RUSTSEC-2026-0375 `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies	Medium	Also affects wasmtime-wasi-http
RUSTSEC-2026-0351 `wasi-http`: Request with long url before query parameter crashes host	Medium	Also affects wasmtime-wasi-http
RUSTSEC-2026-0320 Wasmtime wasi:http implementation panics with a zero timeout supplied	Not rated yet	Also affects wasmtime-wasi-http
RUSTSEC-2026-0313 Outgoing HTTP body write allows guest-driven host memory exhaustion	Medium	Also affects wasmtime-wasi-http

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor