Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 14 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime-Wasi-Http versions before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3; wasmtime-wasi-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.18,introduced=37.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3.

Is there a fix for This vulnerability?

Yes. wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Bytecode Alliance Wasmtime-Wasi-Http or wasmtime-wasi-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Wasmtime WASI HTTP absolute-form request redirect

Severity: medium · CVSS 4 · Published 2026-10-14

Wasmtime is a WebAssembly runtime that allows untrusted guest code to execute in a sandboxed environment. This vulnerability allows guest applications to craft HTTP requests that bypass intended host restrictions and communicate with arbitrary hosts, potentially exposing sensitive data or enabling further attacks against unintended targets.

Technologies: wasmtime-wasi-http (crates.io). Vendors: Bytecode Alliance, crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 14 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime-Wasi-Http versions before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3; wasmtime-wasi-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.18,introduced=37.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3.
Is there a fix for This vulnerability?: Yes. wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Bytecode Alliance Wasmtime-Wasi-Http or wasmtime-wasi-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later
```
cargo update -p wasmtime-wasi-http
```

Technical details

The wasmtime-wasi-http library fails to properly validate absolute-form HTTP requests from guest code, allowing them to target hosts other than the intended recipient. An authenticated guest with user interaction can exploit this via network vectors to gain low-impact confidentiality disclosure. The vulnerability affects versions <36.0.18, 37.0.0–<48.0.6, and 49.0.0–<49.0.3.

Affected products

Bytecode Alliance wasmtime-wasi-http versions before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3

Identifiers

GHSA-5qpp-g3j2-8frx
RUSTSEC-2026-0350

Timeline

2026-10-14: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.