wasmtime-wasi-http has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 5.3 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Weakness classes
Products
- wasmtime-wasi-http 9
Worst active — by depth score
RUSTSEC-2026-0313Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion34CVE-2026-115388Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion34RUSTSEC-2026-0375Medium· 5.3`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies29RUSTSEC-2026-0351Medium· 5.3`wasi-http`: Request with long url before query parameter crashes host29CVE-2026-115382Medium· 4.8Wasmtime wasi:http implementation panics with a zero timeout supplied26
wasmtime-wasi-http vulnerabilities
CVEs affecting wasmtime-wasi-http, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
RUSTSEC-2026-0377Low· 3.7`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
RUSTSEC-2026-0376Low· 3.7`wasi-http`: Guests can add conflicting content lengths to messages
`wasi-http`: Guests can add conflicting content lengths to messages
RUSTSEC-2026-0375Medium· 5.3`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
RUSTSEC-2026-0351Medium· 5.3`wasi-http`: Request with long url before query parameter crashes host
`wasi-http`: Request with long url before query parameter crashes host
RUSTSEC-2026-0350NoneGuests can send absolute-form HTTP requests to different hosts
Guests can send absolute-form HTTP requests to different hosts
CVE-2026-115382Medium· 4.8Wasmtime wasi:http implementation panics with a zero timeout supplied
Wasmtime wasi:http implementation panics with a zero timeout supplied
RUSTSEC-2026-0320NoneWasmtime wasi:http implementation panics with a zero timeout supplied
Wasmtime wasi:http implementation panics with a zero timeout supplied
CVE-2026-115388Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion
Outgoing HTTP body write allows guest-driven host memory exhaustion
RUSTSEC-2026-0313Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion
Outgoing HTTP body write allows guest-driven host memory exhaustion