CVE-2026-121440
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 03, 2026
Vendor
unknown
Description
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.