RUSTSEC-2026-0421: wasi-http p2: outgoing content-length can be invalid or not match body

Q: Does exploitation require authentication or user interaction?

The advisory’s CVSS vector indicates no privileges are required and no user interaction is required. It is assessed as network-reachable, although exploitation has high attack complexity.

Q: What is the expected security impact?

The assessed impact is limited to low integrity impact. No confidentiality or availability impact is indicated by the CVSS vector.

Published Oct 29, 2026

Updated

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398 For more information see the GitHub-hosted security advisory.

Affected Software

4 affected componentsFixes available

rust/wasmtime-wasi-http>=0.0.0-0<36.0.20

36.0.20

rust/wasmtime-wasi-http>=37.0.0<48.0.8

48.0.8

rust/wasmtime-wasi-http>=49.0.0<49.0.5

49.0.5

rust/wasmtime-wasi-http>=50.0.0<50.0.1

50.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/wasmtime-wasi-http to a version that resolves this vulnerability.
Fixed in 36.0.20
Upgrade
Upgrade rust/wasmtime-wasi-http to a version that resolves this vulnerability.
Fixed in 48.0.8
Upgrade
Upgrade rust/wasmtime-wasi-http to a version that resolves this vulnerability.
Fixed in 49.0.5
Upgrade
Upgrade rust/wasmtime-wasi-http to a version that resolves this vulnerability.
Fixed in 50.0.1

Event History

Oct 29, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The advisory’s CVSS vector indicates no privileges are required and no user interaction is required. It is assessed as network-reachable, although exploitation has high attack complexity.

What is the expected security impact?

The assessed impact is limited to low integrity impact. No confidentiality or availability impact is indicated by the CVSS vector.

RUSTSEC-2026-0421: wasi-http p2: outgoing content-length can be invalid or not match body

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the expected security impact?