Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass
cve-program · CVE-2026-121440
PublishedWasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
Read the publisher's advisoryeuvd · EUVD-2026-115862
PublishedWasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
Read the publisher's advisorynvd · CVE-2026-121440
PublishedWasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
Read the publisher's advisoryosv · RUSTSEC-2026-0377
PublishedThis is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33 For more information see the GitHub-hosted security advisory.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-121440 · CVE overview and exploitation status
cve-program · CVE-2026-121440
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33
- https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass
euvd · EUVD-2026-115862
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33
- https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass
nvd · CVE-2026-121440
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33
- https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass
osv · RUSTSEC-2026-0377
Related changes
Linked by CVE identifier- `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook · Advisory content revised · 4 Nov 2026
- Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass · Newly collected advisory · 3 Nov 2026