CVE-2026-121439
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Nov 3, 2026
CISA due date
—
The record
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a… CWE-444
- CVE-2026-55613 uhttpd is a small HTTP server. CWE-444
- CVE-2026-55614 uhttpd is a small HTTP server. CWE-444
- CVE-2026-55612 uhttpd is a small HTTP server. CWE-444
- CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests… CWE-444
- CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which is used… CWE-444
- CVE-2026-118264 Echo is a Go web framework. CWE-444
- CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorrectly… CWE-444