Wasmtime CVE-2026-121440

Exploitation requires an embedder running the wasi-http p3 (WASIp3) implementation that has customized WasiHttpHooks::is_forbidden_header to enforce header restrictions beyond the DEFAULT_FORBIDDEN_HEADERS set, and a WASIp3 guest that forwards an existing request or response body carrying trailers. The bypass is strictly limited to forwarded-body trailers - the hook still applies to directly-set headers, and forwarded trailers are still checked against DEFAULT_FORBIDDEN_HEADERS, so embedders relying only on defaults are unaffected. Deployments not using wasi-http p3, or not customizing the forbidden-header hook, have no exposure. Importantly, even after installing 48.0.7 or 49.0.4, embedders that customized is_forbidden_header must additionally implement the new WasiHttpHooks::forbidden_header_filter method to fully receive the fix; otherwise forwarded trailers continue to be filtered only against DEFAULT_FORBIDDEN_HEADERS.

This is a genuinely low-to-moderate-priority issue despite being network-reachable, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 (Medium), but the impact metrics tell the real story: only VI:L (low integrity) with VC:N and VA:N - no confidentiality or availability impact, and no scope change (SC/SI/SA all N). The high attack complexity (AC:H) and present attack requirement (AT:P) reflect that exploitation only matters in a specific, non-default embedder configuration. The vendor advisory explicitly states 'There is no known attack that this enables,' which strongly tempers the Medium score - this is a defense-in-depth / policy-integrity defect, not a directly exploitable breach. No EPSS score was provided in the input and the CVE is not in CISA KEV, so there is no evidence of exploitation probability or active use. No verified exploit code is referenced. The vuln.today priority is 'this_month,' aligning with a fix-on-normal-patch-cycle posture rather than emergency. Note the 'Information Disclosure' tag is in slight tension with the CVSS vector, which records an integrity impact (VI:L) and explicitly zero confidentiality impact (VC:N) - treat the impact as a header-filtering/policy bypass rather than confirmed data disclosure.

In an embedder that has customized the WasiHttpHooks::is_forbidden_header hook to enforce header restrictions stricter than the default set, a malicious or buggy WASIp3 guest forwards an existing request or response body whose trailers carry a header the embedder intended to block. Because forwarded trailers skip the custom hook, the restricted header reaches its destination, undermining the embedder's intended policy. No public exploit is identified at time of analysis, and the vendor notes no known concrete attack this enables.