Threats tagged 'ghsa-9ccp-mgf6-9v48'

Wasmtime versions before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contain a request smuggling vulnerability in the wasi-http component. This flaw allows malicious guests to set multiple conflicting content-length headers, potentially causing the host to send HTTP requests with conflicting content-length values. Such requests can be used to smuggle requests through servers or intermediaries that do not reject them. The vulnerability has a low severity score and no known exploits in the wild.