DEBIAN-CVE-2026-119130: Low severity debian/rust-wasmtime vulnerability
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using wasmtime-wasi-http are exposed when an untrusted or malicious WebAssembly guest can control set-path-with-query values and the configured authority is a forward proxy or gateway that honors absolute-form HTTP request targets. The impact is specifically bypassing embedder policies intended to restrict reachable hosts.
What must an attacker be able to do to exploit it?
An attacker needs the ability to run or control a guest that can provide a set-path-with-query value. They must supply an absolute-form URL, and the request must be sent through an allowed authority that forwards or routes that URL to another host.
Which versions need remediation?
Affected versions are Wasmtime before 36.0.18, versions 37.0.0 through before 48.0.6, and versions 49.0.0 through before 49.0.3. Upgrade to 36.0.18, 48.0.6, 49.0.3, or a later applicable release.
What can be done if upgrading is not immediately possible?
Do not allow untrusted guests to control set-path-with-query values. Avoid configuring an allowed authority as a forward proxy or gateway that accepts absolute-form request targets, and ensure such intermediaries cannot route requests to hosts prohibited by embedder filtering policies.