CVE-2026-119130 bytecodealliance CVE debrief

Who should care

Roles responsible for deploying and managing Wasmtime WASI HTTP should assess exposure, prioritize patching, and monitor for unusual activity. Affected operator, platform, vulnerability-management, and security-team impact should be considered. Deployments should be reviewed for potential exposure, and patching or mitigation should be prioritized based on deployment context.

Why it matters

CVE-2026-119130 allows guests to send absolute-form HTTP requests to different hosts in Wasmtime WASI HTTP. This issue requires patching or mitigation to prevent potential unauthorized requests. Affected deployments should be identified and updated to versions 36.0.18, 48.0.6, or 49.0.3. Further verification of exposure and impacts is necessary.

• Verify patch alignment to prevent unauthorized HTTP requests.
• Monitor guest environment activity for potential misuse.
• Assess exposure of Wasmtime WASI HTTP deployments.
• Prioritize patching or mitigation based on deployment context.

Technical summary

CVE-2026-119130 allows guests to send absolute-form HTTP requests to different hosts in Wasmtime WASI HTTP. This issue was addressed in versions 36.0.18, 48.0.6, and 49.0.3. Affected deployments should be inventoried and patched or mitigated. The vulnerability requires patching or mitigation to prevent potential unauthorized requests, and further verification of exposure and impacts is necessary. The issue is related to Wasmtime WASI HTTP, and defensive actions should be taken to prevent potential misuse. The CVE record, RustSec advisory, and NVD offer additional assessment and details on the vulnerability.

Defensive priority

Assess exposure of Wasmtime WASI HTTP deployments, verify version alignment, and apply patches or compensating controls as needed.

Recommended defensive actions

• Inventory Wasmtime WASI HTTP deployments and verify version alignment with patched releases (36.0.18, 48.0.6, or 49.0.3).
• Apply patches or compensating controls to mitigate potential impacts.
• Monitor for unusual HTTP request patterns from guest environments.
• Assess exposure of Wasmtime WASI HTTP deployments.
• Verify patch alignment to prevent unauthorized HTTP requests.
• Prioritize patching or mitigation based on deployment context.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and RustSec advisory provide details on the vulnerability, while NVD offers additional assessment. Affected versions and patches are noted, but further verification is required. The issue requires patching or mitigation to prevent potential unauthorized requests. Evidence is limited to public sources, and defensive verification tasks are necessary to confirm exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.