wasmtime-wasi-http vulnerabilities
CVEs whose affected-version data names the wasmtime-wasi-http package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
RUSTSEC-2026-0377Low· 3.7`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
RUSTSEC-2026-0376Low· 3.7`wasi-http`: Guests can add conflicting content lengths to messages
`wasi-http`: Guests can add conflicting content lengths to messages
RUSTSEC-2026-0375Medium· 5.3`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
RUSTSEC-2026-0351Medium· 5.3`wasi-http`: Request with long url before query parameter crashes host
`wasi-http`: Request with long url before query parameter crashes host
RUSTSEC-2026-0350NoneGuests can send absolute-form HTTP requests to different hosts
Guests can send absolute-form HTTP requests to different hosts
CVE-2026-115382Medium· 4.8Wasmtime wasi:http implementation panics with a zero timeout supplied
Wasmtime wasi:http implementation panics with a zero timeout supplied
RUSTSEC-2026-0320NoneWasmtime wasi:http implementation panics with a zero timeout supplied
Wasmtime wasi:http implementation panics with a zero timeout supplied
CVE-2026-115388Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion
Outgoing HTTP body write allows guest-driven host memory exhaustion
RUSTSEC-2026-0313Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion
Outgoing HTTP body write allows guest-driven host memory exhaustion