{"id":"EUVD-2026-113198","enisaUuid":"5a68674d-560e-3da0-a60f-4b691ab49d2d","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a \u0027?\u0027 after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.","datePublished":"Oct 29, 2026, 3:58:12 PM","dateUpdated":"Nov 4, 2026, 1:27:13 AM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-wasi-http\n","aliases":"CVE-2026-119131\nGHSA-9vvr-fpgq-p9gc\n","assigner":"VulnCheck","epss":0.3,"enisaIdProduct":[{"id":"9bf8e69d-2ca7-3b4d-867c-88931df4cd28","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"9fad328d-30e2-30c4-8bbd-a2c92c7d3c28","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"enisaIdVendor":[{"id":"f6179729-bf89-38d6-b4cc-178bcc9a0fe6","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"9d4b0a34-5703-3f99-bc71-4b52b82bb0d4","vulnerability":{"id":"GHSA-9vvr-fpgq-p9gc","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a \u0027?\u0027 after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.","datePublished":"Oct 29, 2026, 6:30:59 PM","dateUpdated":"Oct 29, 2026, 6:30:59 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119131\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-wasi-http\n","enisa_id":"EUVD-2026-113198\n","aliases":"GHSA-9vvr-fpgq-p9gc\nCVE-2026-119131\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9e20b356-2b3b-3ef4-b601-b9c4c70092ff","vulnerability":{"id":"CVE-2026-119131","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a \u0027?\u0027 after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.","datePublished":"Oct 29, 2026, 3:58:12 PM","dateUpdated":"Nov 4, 2026, 1:27:13 AM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-wasi-http\n","enisa_id":"EUVD-2026-113198\n","assigner":"VulnCheck","epss":0.3,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"5b354b97-6773-3b9c-896f-b47dc8b14e0f","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"},{"id":"83ee834b-68a1-33e6-87f4-8bf30bdcc011","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"vulnerabilityVendor":[{"id":"7a171b8d-cf5c-3d86-bed0-8d226812d3a6","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}