CVE-2026-119130

Low

Description

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.

SeverityLow

CVSS2.6

Exploit probability—

ProductBytecodealliance Wasmtime

PublishedOct 29, 2026

First seenNov 4, 2026

Weakness typeCWE-20Improper input validation

How to fix

Update

bytecodealliance wasmtime36.0.18, 48.0.6, 49.0.3 or later

Vendor advisories

github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx

Affected products

Product	Affected versions	Fixed in
bytecodealliance wasmtime	v < 36.0.18, 37.0.0 ≤ v < 48.0.6, 49.0.0 ≤ v < 49.0.3	36.0.18, 48.0.6, 49.0.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.