Input validation error in Wasmtime - #VU155838
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote user to bypass host filtering policies and send HTTP requests to disallowed hosts.
The vulnerability exists due to improper input validation in the wasmtime-wasi-http implementation of wasi:http when processing guest-supplied outgoing request paths. A remote user can supply an absolute-form URL to set-path-with-query to bypass host filtering policies and send HTTP requests to disallowed hosts.
Exploitation requires the allowed authority to be a forward proxy or gateway that honors absolute-form request targets. Wasmtime connects to the configured authority and uses it for the Host header, but the intermediary can forward the request according to the absolute-form target instead.