CVE-2026-119130

    Dashboard / Vulnerabilities / CVE-2026-119130

    CVE-2026-119130

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

    Details: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119130.json, https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx, https://nvd.nist.gov/vuln/detail/CVE-2026-119130, https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c90f2dd4b712703c52e834c08f42e882ee278ba5

    Affected versions

    v48.0.5
    v48.0.4
    v48.0.3
    v48.0.2
    v48.0.1
    v48.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119130 | CVE-DB