RUSTSEC-2026-0421 GHSA-h4wp-g4x3-7398
wasi-http p2: outgoing content-length can be invalid or not match body
- Severity
- 3.7 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
50.0.1- Upgrade wasmtime-wasi-http to this version or later
Description
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398 For more information see the GitHub-hosted security advisory.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| wasmtime-wasi-http | >= 0.0.0-0, < 36.0.20>= 37.0.0, < 48.0.8>= 49.0.0, < 49.0.5>= 50.0.0, < 50.0.1 |
36.0.2048.0.849.0.550.0.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
wasmtime-wasi-http crates.io → 50.0.1
- cargo
cargo update -p wasmtime-wasi-http --precise 50.0.1
Severity breakdown
CVSS 3.1 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0377 `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook | Low | Also affects wasmtime-wasi-http |
| RUSTSEC-2026-0376 `wasi-http`: Guests can add conflicting content lengths to messages | Low | Also affects wasmtime-wasi-http |
| RUSTSEC-2026-0375 `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies | Medium | Also affects wasmtime-wasi-http |
| RUSTSEC-2026-0351 `wasi-http`: Request with long url before query parameter crashes host | Medium | Also affects wasmtime-wasi-http |
| RUSTSEC-2026-0350 Guests can send absolute-form HTTP requests to different hosts | Not rated yet | Also affects wasmtime-wasi-http |
| RUSTSEC-2026-0320 Wasmtime wasi:http implementation panics with a zero timeout supplied | Not rated yet | Also affects wasmtime-wasi-http |
| RUSTSEC-2026-0313 Outgoing HTTP body write allows guest-driven host memory exhaustion | Medium | Also affects wasmtime-wasi-http |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor