RUSTSEC-2026-0351 CVE-2026-119131 GHSA-w36r-2hch-9xp9

`wasi-http`: Request with long url before query parameter crashes host

Medium crates.io

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.30%; Chance of exploitation in the next 30 days. Higher than 23.25% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 49.0.3; Upgrade wasmtime-wasi-http to this version or later

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9 For more information see the GitHub-hosted security advisory.

Affected versions

crates.io

Package	Vulnerable	Fixed in
wasmtime-wasi-http	`>= 46.0.0, < 48.0.6` `>= 49.0.0, < 49.0.3`	`48.0.6` `49.0.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

wasmtime-wasi-http crates.io → `49.0.3`

cargo

cargo update -p wasmtime-wasi-http --precise 49.0.3

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0351.html

Packages

crates.io/crates/wasmtime-wasi-http

Timeline

Oct 14, 2026 Published
Oct 30, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
RUSTSEC-2026-0421 wasi-http p2: outgoing content-length can be invalid or not match body	Low	Also affects wasmtime-wasi-http
RUSTSEC-2026-0377 `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook	Low	Also affects wasmtime-wasi-http
RUSTSEC-2026-0376 `wasi-http`: Guests can add conflicting content lengths to messages	Low	Also affects wasmtime-wasi-http
RUSTSEC-2026-0375 `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies	Medium	Also affects wasmtime-wasi-http
RUSTSEC-2026-0350 Guests can send absolute-form HTTP requests to different hosts	Not rated yet	Also affects wasmtime-wasi-http
RUSTSEC-2026-0320 Wasmtime wasi:http implementation panics with a zero timeout supplied	Not rated yet	Also affects wasmtime-wasi-http
RUSTSEC-2026-0313 Outgoing HTTP body write allows guest-driven host memory exhaustion	Medium	Also affects wasmtime-wasi-http

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor