# RUSTSEC-2026-0351 - `wasi-http`: Request with long url before query parameter crashes host

Source: https://junglewise.ai/threats/rustsec-2026-0351-wasi-http-request-with-long-url-before-query-5b91b430  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-10-14

`wasi-http`: Request with long url before query parameter crashes host

Technologies: [wasmtime-wasi-http (crates.io)](https://junglewise.ai/threats/technologies/wasmtime-wasi-http). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 14 October 2026.

**Which products and versions are affected?** wasmtime-wasi-http (crates.io) SEMVER:introduced=46.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3.

**Is there a fix for This vulnerability?** Yes. wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run wasmtime-wasi-http (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wasmtime-wasi-http (crates.io): upgrade to 49.0.3 or later

  ```sh
  cargo update -p wasmtime-wasi-http
  ```


## Affected products

- wasmtime-wasi-http (crates.io) SEMVER:introduced=46.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3

## Identifiers

- GHSA-w36r-2hch-9xp9
- RUSTSEC-2026-0351

## Related threats

- [RUSTSEC-2026-0421 - wasi-http p2: outgoing content-length can be invalid or not match body](https://junglewise.ai/threats/rustsec-2026-0421-wasi-http-p2-outgoing-content-length-can-be-invalid-0d34a0cb)
- [RUSTSEC-2026-0375 - `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies](https://junglewise.ai/threats/rustsec-2026-0375-wasi-http-p3-guests-can-set-incorrect-content-length-2c05e20d)
- [RUSTSEC-2026-0377 - `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook](https://junglewise.ai/threats/rustsec-2026-0377-wasi-http-p3-forwarded-trailers-aren-t-checked-9789d51f)
- [RUSTSEC-2026-0376 - `wasi-http`: Guests can add conflicting content lengths to messages](https://junglewise.ai/threats/rustsec-2026-0376-wasi-http-guests-can-add-conflicting-content-lengths-ab318814)
- [Wasmtime WASI HTTP absolute-form request redirect](https://junglewise.ai/threats/rustsec-2026-0350-guests-can-send-absolute-form-http-requests-to-c9af59e3)