CVE-2026-121440

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

6.3 MediumFix available

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.22%Unchanged since Nov 4, 2026

What each source reports

CVE List Score used 6.3

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Record: CVE-2026-121440
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-424
Updated: 2026-11-03

EUVDEUVD-2026-115862 6.3

Record: EUVD-2026-115862
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j86m-34pm-p9mv 6.3

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against...

Record: GHSA-j86m-34pm-p9mv
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-424
Updated: 2026-11-03

NVD 6.3

Record: CVE-2026-121440
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-424
Updated: 2026-11-03

OSV 6.3

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Record: CVE-2026-121440
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-424
Updated: 2026-11-07

OSVRUSTSEC-2026-0377 3.7

`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33 For more information see the GitHub-hosted security advisory.

Record: RUSTSEC-2026-0377
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-04

Affected products

bytecodealliance wasmtime

Affected packages

Affected packages
Package	Affected	Fixed
`wasmtime-wasi-http` crates.io	46.0.0 up to 48.0.7, 49.0.0 up to 49.0.4	48.0.749.0.4

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts, published, references	CVE List, EUVD, NVD, OSV
Nov 3, 2026	published	EUVD, NVD
Nov 3, 2026	facts, published	EUVD
Nov 3, 2026	aliases, published	EUVD
Nov 3, 2026	first indexed	CVE List, GitHub Advisories
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-121440 is a medium vulnerability (CVSS 6.3) in Bytecodealliance Wasmtime, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in wasmtime-wasi-http 48.0.7.