Critical Vulnerability in wasmtime-wasi-http: Long URL Request Crashes Host
Summary
RUSTSEC-2026-0351: wasi-http: Request with long url before query parameter crashes host. Affects wasmtime-wasi-http across 2 version ranges.
>= 46.0.0, < 48.0.6
>= 49.0.0, < 49.0.3
Fixed in 48.0.6 or 49.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wasmtime-wasi-http package is a Rust library that enables WebAssembly applications to make HTTP requests in a WASI (WebAssembly System Interface) environment. It provides essential functionalities for handling HTTP interactions, making it a vital component for developers working with WebAssembly. However, a recently discovered vulnerability exposes the package to potential crashes when handling requests with excessively long URLs before query parameters.
Vulnerability Detail
The vulnerability arises from the handling of requests with long URLs in the wasmtime-wasi-http package. When a URL exceeds a certain length, it can cause the host environment to crash, leading to service disruptions. This issue is particularly concerning as it can be exploited by malicious actors to create denial-of-service conditions, affecting the availability of applications relying on this package. The vulnerability has been cataloged in the RustSec database and is linked to specific versions of the package, making it crucial for users to be aware of the affected versions.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.648.0.6 -
>= 49.0.0, < 49.0.349.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to restrict the length of URLs processed by your application. This can prevent excessively long URLs from being sent to the wasmtime-wasi-http package, thereby avoiding potential crashes.
Conclusion
The wasmtime-wasi-http package has a critical vulnerability that can cause host crashes when processing long URL requests. Users are strongly advised to update to the latest patched versions to mitigate risks. Implementing input validation can serve as a temporary workaround while transitioning to the fixed versions.
See every vulnerability recorded for wasmtime-wasi-http →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
The affected versions are 46.0.0, 49.0.0, and any versions prior to 48.0.6 and 49.0.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploiting this vulnerability can lead to denial-of-service conditions, causing applications to crash and become unavailable.
Yes, updating to the patched versions 48.0.6 or 49.0.3 resolves the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime-wasi-http.
