Rust advisories / crate
Security history · wasmtime-wasi-http · data from Oct 24, 2026
Is wasmtime-wasi-http safe to use? Its security history
VerdictNo open advisories. 7 past vulnerabilities were fixed; use 49.0.4 or newer to be clear of all of them.
7advisories on record
7vulnerabilities
0unmaintained notices
49.0.4newest fixed version
Every advisory, newest first
- Vulnerability MediumRUSTSEC-2026-0375 · 2026-10-19`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
- Vulnerability LowRUSTSEC-2026-0376 · 2026-10-19`wasi-http`: Guests can add conflicting content lengths to messages
- Vulnerability LowRUSTSEC-2026-0377 · 2026-10-19`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook
- VulnerabilityRUSTSEC-2026-0350 · 2026-10-14Guests can send absolute-form HTTP requests to different hosts
- Vulnerability MediumRUSTSEC-2026-0351 · 2026-10-14`wasi-http`: Request with long url before query parameter crashes host
- VulnerabilityRUSTSEC-2026-0320 · 2026-10-02Wasmtime wasi:http implementation panics with a zero timeout supplied
- Vulnerability MediumRUSTSEC-2026-0313 · 2026-09-24Outgoing HTTP body write allows guest-driven host memory exhaustion
Check your version
Run cargo tree -i wasmtime-wasi-http to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.
RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.
Up next
Are you affected?Check your whole dependency treeRead it next →Also worth your time
Did this answer your question?