Threats tagged 'ghsa-pr9x-c379-2x4g'

Wasmtime versions before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 contain a vulnerability in the wasmtime-wasi-http component where set-path-with-query values are not properly verified as paths. This allows absolute-form URLs to be used verbatim as HTTP/1.1 request targets, potentially enabling a malicious guest to bypass embedder filtering policies and reach unauthorized hosts via forward proxies or gateways.