{"id":"EUVD-2026-113197","enisaUuid":"3ac1c855-0048-39ed-9ac6-1220d34e7789","description":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.","datePublished":"Oct 29, 2026, 3:58:12 PM","dateUpdated":"Oct 29, 2026, 8:14:54 PM","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx\nhttps://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling\n","aliases":"CVE-2026-119130\nGHSA-pr9x-c379-2x4g\n","assigner":"VulnCheck","epss":0.24,"enisaIdProduct":[{"id":"8076b965-b316-3a22-a7ae-0645727c1b74","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0 \u003c48.0.6"},{"id":"ac0df877-3341-3282-8be0-790772e0ffd9","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"e9a81245-30ec-3fec-9626-3ab026314808","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"0 \u003c36.0.18"}],"enisaIdVendor":[{"id":"a400ff9f-fc97-3225-9101-133d43c0fe21","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"3081e7a1-e37f-34da-8fef-c590944b5c38","vulnerability":{"id":"GHSA-pr9x-c379-2x4g","description":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.","datePublished":"Oct 29, 2026, 6:30:59 PM","dateUpdated":"Oct 29, 2026, 6:30:59 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119130\nhttps://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling\n","enisa_id":"EUVD-2026-113197\n","aliases":"GHSA-pr9x-c379-2x4g\nCVE-2026-119130\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:09:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cac86793-a5c6-384f-ae52-26e40e6d8f7a","vulnerability":{"id":"CVE-2026-119130","description":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.","datePublished":"Oct 29, 2026, 3:58:12 PM","dateUpdated":"Oct 29, 2026, 8:14:54 PM","status":"PUBLISHED","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx\nhttps://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling\n","enisa_id":"EUVD-2026-113197\n","assigner":"VulnCheck","epss":0.24,"dataProcessed":"Nov 1, 2026, 4:04:21 AM","vulnerabilityProduct":[{"id":"00a64e1a-014c-37be-a66f-e72c880a0e1e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"0 \u003c36.0.18"},{"id":"822a1ece-6bb8-3cd7-aa71-3e97e7bbe76a","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"e2d9d944-6c2d-3c5f-ba54-9a00b594a3e7","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0 \u003c48.0.6"}],"vulnerabilityVendor":[{"id":"ea9c6aff-ba27-3681-8d01-526e5634c798","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}