Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-119130 · Microsoft / collected KEV context

EUVD-2026-113197

GHSA-pr9x-c379-2x4g

RUSTSEC-2026-0350

GHSA-5qpp-g3j2-8frx

cve-program · CVE-2026-119130

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx
• https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling

euvd · EUVD-2026-113197

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx
• https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling

nvd · CVE-2026-119130

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx
• https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling

osv · RUSTSEC-2026-0350

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0350.html
• https://github.com/bytecodealliance/wasmtime/pull/14727

• Guests can send absolute-form HTTP requests to different hosts · Advisory content revised · 30 Oct 2026
• Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling · Newly collected advisory · 29 Oct 2026