# Wasmtime WASI HTTP absolute-form request redirect

Source: https://junglewise.ai/threats/rustsec-2026-0350-guests-can-send-absolute-form-http-requests-to-c9af59e3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-10-14

Wasmtime is a WebAssembly runtime that allows untrusted guest code to execute in a sandboxed environment. This vulnerability allows guest applications to craft HTTP requests that bypass intended host restrictions and communicate with arbitrary hosts, potentially exposing sensitive data or enabling further attacks against unintended targets.

Technologies: [wasmtime-wasi-http (crates.io)](https://junglewise.ai/threats/technologies/wasmtime-wasi-http). Vendors: [Bytecode Alliance](https://junglewise.ai/threats/vendors/bytecode-alliance), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 14 October 2026.

**Which products and versions are affected?** Bytecode Alliance Wasmtime-Wasi-Http versions before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3; wasmtime-wasi-http (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.18,introduced=37.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3.

**Is there a fix for This vulnerability?** Yes. wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Bytecode Alliance Wasmtime-Wasi-Http or wasmtime-wasi-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later

  ```sh
  cargo update -p wasmtime-wasi-http
  ```


## Technical details

The wasmtime-wasi-http library fails to properly validate absolute-form HTTP requests from guest code, allowing them to target hosts other than the intended recipient. An authenticated guest with user interaction can exploit this via network vectors to gain low-impact confidentiality disclosure. The vulnerability affects versions <36.0.18, 37.0.0–<48.0.6, and 49.0.0–<49.0.3.

## Affected products

- Bytecode Alliance wasmtime-wasi-http versions before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3

## Identifiers

- GHSA-5qpp-g3j2-8frx
- RUSTSEC-2026-0350

## Timeline

- 2026-10-14: disclosed
- 2026-10-14: advisory

## References

- [https://crates.io/crates/wasmtime-wasi-http](https://crates.io/crates/wasmtime-wasi-http)
- [https://rustsec.org/advisories/RUSTSEC-2026-0350.html](https://rustsec.org/advisories/RUSTSEC-2026-0350.html)

## Related threats

- [RUSTSEC-2026-0421 - wasi-http p2: outgoing content-length can be invalid or not match body](https://junglewise.ai/threats/rustsec-2026-0421-wasi-http-p2-outgoing-content-length-can-be-invalid-0d34a0cb)
- [RUSTSEC-2026-0375 - `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies](https://junglewise.ai/threats/rustsec-2026-0375-wasi-http-p3-guests-can-set-incorrect-content-length-2c05e20d)
- [RUSTSEC-2026-0377 - `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook](https://junglewise.ai/threats/rustsec-2026-0377-wasi-http-p3-forwarded-trailers-aren-t-checked-9789d51f)
- [RUSTSEC-2026-0376 - `wasi-http`: Guests can add conflicting content lengths to messages](https://junglewise.ai/threats/rustsec-2026-0376-wasi-http-guests-can-add-conflicting-content-lengths-ab318814)
- [RUSTSEC-2026-0351 - `wasi-http`: Request with long url before query parameter crashes host](https://junglewise.ai/threats/rustsec-2026-0351-wasi-http-request-with-long-url-before-query-5b91b430)