- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 8 · 6 medium, 1 low
- Registry
- crates.io
Advisories 8
- CVE-2026-121441Medium 6.3
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling
Affected: fixed in 36.0.19; from 37.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4.
- CVE-2026-121440Medium 6.3
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass
Affected: from 46.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4.
- CVE-2026-121439Medium 6.9
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http
Affected: from 46.0.0, fixed in 48.0.7; from 49.0.0, fixed in 49.0.4.
- CVE-2026-119131Medium 6.9
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
Affected: from 46.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
- CVE-2026-119130Low 2.1
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
Affected: fixed in 36.0.18; from 37.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3.
- RUSTSEC-2026-0421Unrated
wasi-http p2: outgoing content-length can be invalid or not match body
Affected: fixed in 36.0.20; from 37.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1.
- CVE-2026-115388Medium 6.9
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write
Affected: fixed in 36.0.16; from 37.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1.
- CVE-2026-115382Medium 5.9
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS
Affected: from 46.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2.