CVE-2026-126406: Wasmtime before 36.0.20 HTTP Request Smuggling via wasi-http p2 Content-Length
The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a received response's headers resource to send a bodyless request can enable request smuggling against non-compliant servers, potentially bypassing embedder destination access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.20 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 48.0.8 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.5 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 50.0.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the wasmtime-wasi-http p2 implementation are affected if they run Wasmtime before 36.0.20, versions 37.0.0 through before 48.0.8, versions 49.0.0 through before 49.0.5, or versions 50.0.0 through before 50.0.1. The issue concerns outgoing HTTP requests created by a guest.
What must an attacker-controlled guest do to exploit this?
The guest must reuse a received response's headers resource when sending a request with no body. This can cause Wasmtime to send conflicting Content-Length headers or a Content-Length value that does not match the body.
When is request smuggling possible?
Exploitation depends on the destination HTTP server being non-compliant in its handling of conflicting or invalid Content-Length headers. Under those conditions, the flaw can enable request smuggling and potentially bypass destination access controls imposed by the embedder.
What versions contain fixes?
The fixed releases are 36.0.20, 48.0.8, 49.0.5, and 50.0.1. Upgrade to the applicable fixed release for the Wasmtime release line in use.