{"schema_version":1,"title":"wasmtime-wasi-http (crates.io) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in wasmtime-wasi-http (crates.io): 0 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, RUSTSEC-2026-0421 - wasi-http p2: outgoing content-length can be invalid or…, was published on 29 October 2026. 6 vulnerabilities in the last four weeks, up 200% on the four before (2).","url":"https://junglewise.ai/threats/technologies/wasmtime-wasi-http","json_url":"https://junglewise.ai/threats/technologies/wasmtime-wasi-http.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/wasmtime-wasi-http","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":0,"all_time":8,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":6,"last_90_days":8,"last_365_days":8},"latest":[{"cvss":3.1,"slug":"rustsec-2026-0421-wasi-http-p2-outgoing-content-length-can-be-invalid-0d34a0cb","title":"RUSTSEC-2026-0421 - wasi-http p2: outgoing content-length can be invalid or not match body","severity":"low","exploited":false,"published_at":"2026-10-29T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0421-wasi-http-p2-outgoing-content-length-can-be-invalid-0d34a0cb"},{"cvss":3.1,"slug":"rustsec-2026-0375-wasi-http-p3-guests-can-set-incorrect-content-length-2c05e20d","title":"RUSTSEC-2026-0375 - `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies","severity":"low","exploited":false,"published_at":"2026-10-19T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0375-wasi-http-p3-guests-can-set-incorrect-content-length-2c05e20d"},{"cvss":3.1,"slug":"rustsec-2026-0377-wasi-http-p3-forwarded-trailers-aren-t-checked-9789d51f","title":"RUSTSEC-2026-0377 - `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook","severity":"low","exploited":false,"published_at":"2026-10-19T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0377-wasi-http-p3-forwarded-trailers-aren-t-checked-9789d51f"},{"cvss":3.1,"slug":"rustsec-2026-0376-wasi-http-guests-can-add-conflicting-content-lengths-ab318814","title":"RUSTSEC-2026-0376 - `wasi-http`: Guests can add conflicting content lengths to messages","severity":"low","exploited":false,"published_at":"2026-10-19T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0376-wasi-http-guests-can-add-conflicting-content-lengths-ab318814"},{"cvss":3.1,"slug":"rustsec-2026-0351-wasi-http-request-with-long-url-before-query-5b91b430","title":"RUSTSEC-2026-0351 - `wasi-http`: Request with long url before query parameter crashes host","severity":"low","exploited":false,"published_at":"2026-10-14T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0351-wasi-http-request-with-long-url-before-query-5b91b430"},{"cvss":4,"slug":"rustsec-2026-0350-guests-can-send-absolute-form-http-requests-to-c9af59e3","title":"Wasmtime WASI HTTP absolute-form request redirect","severity":"medium","exploited":false,"published_at":"2026-10-14T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0350-guests-can-send-absolute-form-http-requests-to-c9af59e3"},{"cvss":4,"slug":"rustsec-2026-0320-wasmtime-wasi-http-implementation-panics-with-a-zero-849ad606","title":"Wasmtime wasi:http implementation panic with zero timeout","severity":"medium","exploited":false,"published_at":"2026-10-02T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0320-wasmtime-wasi-http-implementation-panics-with-a-zero-849ad606"},{"cvss":3.1,"slug":"rustsec-2026-0313-outgoing-http-body-write-allows-guest-driven-host-c0081240","title":"RUSTSEC-2026-0313 - Outgoing HTTP body write allows guest-driven host memory exhaustion","severity":"low","exploited":false,"published_at":"2026-09-24T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0313-outgoing-http-body-write-allows-guest-driven-host-c0081240"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"surrealdb (crates.io)","slug":"surrealdb","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/surrealdb"},{"name":"wasmtime (crates.io)","slug":"wasmtime","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/wasmtime"},{"name":"deno (crates.io)","slug":"deno","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/deno"},{"name":"zebrad (crates.io)","slug":"zebrad","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/zebrad"},{"name":"russh (crates.io)","slug":"crates-io-russh","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/crates-io-russh"},{"name":"openssl-src (crates.io)","slug":"openssl-src","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/openssl-src"},{"name":"openssl (crates.io)","slug":"crates-io-openssl","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/crates-io-openssl"},{"name":"rustfs (crates.io)","slug":"rustfs","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/rustfs"},{"name":"coreutils (crates.io)","slug":"crates-io-coreutils","vulnerabilities":21,"url":"https://junglewise.ai/threats/technologies/crates-io-coreutils"},{"name":"ckb (crates.io)","slug":"ckb","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/ckb"},{"name":"apollo-router (crates.io)","slug":"apollo-router","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/apollo-router"},{"name":"deepseek-tui (crates.io)","slug":"deepseek-tui","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/deepseek-tui"}],"technology":{"hub":true,"name":"wasmtime-wasi-http (crates.io)","slug":"wasmtime-wasi-http","vendor":{"hub":true,"name":"crates.io","slug":"crates-io","url":"https://junglewise.ai/threats/vendors/crates-io"},"aliases":[],"description":"WebAssembly runtime module implementing WASI HTTP interface for making HTTP requests from WASM programs.","url":"https://junglewise.ai/threats/technologies/wasmtime-wasi-http"},"most_severe":[{"cvss":4,"slug":"rustsec-2026-0350-guests-can-send-absolute-form-http-requests-to-c9af59e3","title":"Wasmtime WASI HTTP absolute-form request redirect","severity":"medium","exploited":false,"published_at":"2026-10-14T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0350-guests-can-send-absolute-form-http-requests-to-c9af59e3"},{"cvss":4,"slug":"rustsec-2026-0320-wasmtime-wasi-http-implementation-panics-with-a-zero-849ad606","title":"Wasmtime wasi:http implementation panic with zero timeout","severity":"medium","exploited":false,"published_at":"2026-10-02T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0320-wasmtime-wasi-http-implementation-panics-with-a-zero-849ad606"},{"cvss":3.1,"slug":"rustsec-2026-0421-wasi-http-p2-outgoing-content-length-can-be-invalid-0d34a0cb","title":"RUSTSEC-2026-0421 - wasi-http p2: outgoing content-length can be invalid or not match body","severity":"low","exploited":false,"published_at":"2026-10-29T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0421-wasi-http-p2-outgoing-content-length-can-be-invalid-0d34a0cb"},{"cvss":3.1,"slug":"rustsec-2026-0377-wasi-http-p3-forwarded-trailers-aren-t-checked-9789d51f","title":"RUSTSEC-2026-0377 - `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook","severity":"low","exploited":false,"published_at":"2026-10-19T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0377-wasi-http-p3-forwarded-trailers-aren-t-checked-9789d51f"},{"cvss":3.1,"slug":"rustsec-2026-0376-wasi-http-guests-can-add-conflicting-content-lengths-ab318814","title":"RUSTSEC-2026-0376 - `wasi-http`: Guests can add conflicting content lengths to messages","severity":"low","exploited":false,"published_at":"2026-10-19T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0376-wasi-http-guests-can-add-conflicting-content-lengths-ab318814"},{"cvss":3.1,"slug":"rustsec-2026-0375-wasi-http-p3-guests-can-set-incorrect-content-length-2c05e20d","title":"RUSTSEC-2026-0375 - `wasi-http` p3: Guests can set incorrect content-length for spliced response bodies","severity":"low","exploited":false,"published_at":"2026-10-19T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0375-wasi-http-p3-guests-can-set-incorrect-content-length-2c05e20d"},{"cvss":3.1,"slug":"rustsec-2026-0351-wasi-http-request-with-long-url-before-query-5b91b430","title":"RUSTSEC-2026-0351 - `wasi-http`: Request with long url before query parameter crashes host","severity":"low","exploited":false,"published_at":"2026-10-14T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0351-wasi-http-request-with-long-url-before-query-5b91b430"},{"cvss":3.1,"slug":"rustsec-2026-0313-outgoing-http-body-write-allows-guest-driven-host-c0081240","title":"RUSTSEC-2026-0313 - Outgoing HTTP body write allows guest-driven host memory exhaustion","severity":"low","exploited":false,"published_at":"2026-09-24T12:00:00+00:00","url":"https://junglewise.ai/threats/rustsec-2026-0313-outgoing-http-body-write-allows-guest-driven-host-c0081240"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}