wasmtime-wasi-http (crates.io)
Advisories
8
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 50.0.1 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p wasmtime-wasi-http --precise 50.0.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| RUSTSEC-2026-0421 wasi-http p2: outgoing content-length can be invalid or not match body |
Low | >= 0.0.0-0, < 36.0.20>= 37.0.0, < 48.0.8>= 49.0.0, < 49.0.5>= 50.0.0, < 50.0.1 | 36.0.2048.0.849.0.550.0.1 |
| RUSTSEC-2026-0375 `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies |
Medium | >= 46.0.0, < 48.0.7>= 49.0.0, < 49.0.4 | 48.0.749.0.4 |
| RUSTSEC-2026-0376 `wasi-http`: Guests can add conflicting content lengths to messages |
Low | >= 0.0.0-0, < 36.0.19>= 37.0.0, < 48.0.7>= 49.0.0, < 49.0.4 | 36.0.1948.0.749.0.4 |
| RUSTSEC-2026-0377 `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook |
Low | >= 46.0.0, < 48.0.7>= 49.0.0, < 49.0.4 | 48.0.749.0.4 |
| RUSTSEC-2026-0350 Guests can send absolute-form HTTP requests to different hosts |
Not rated yet EPSS 0.24% |
>= 0.0.0-0, < 36.0.18>= 37.0.0, < 48.0.6>= 49.0.0, < 49.0.3 | 36.0.1848.0.649.0.3 |
| RUSTSEC-2026-0351 `wasi-http`: Request with long url before query parameter crashes host |
Medium EPSS 0.30% |
>= 46.0.0, < 48.0.6>= 49.0.0, < 49.0.3 | 48.0.649.0.3 |
| RUSTSEC-2026-0320 Wasmtime wasi:http implementation panics with a zero timeout supplied |
Not rated yet EPSS 0.28% |
>= 46.0.0, < 48.0.4>= 49.0.0, < 49.0.2 | 48.0.449.0.2 |
| RUSTSEC-2026-0313 Outgoing HTTP body write allows guest-driven host memory exhaustion |
Medium EPSS 0.11% |
>= 0.0.0-0, < 36.0.16>= 37.0.0, < 48.0.3>= 49.0.0, < 49.0.1 | 36.0.1648.0.349.0.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor