Wasmtime GitHub notifications bot (Oct 14 2026 at 12:41): Wasmtime GitHub notifications bot (Oct 14 2026 at 12:41):xia-chao opened PR #14718 from xia-chao:wasi-http-single-content-length to bytecodealliance:main:
Content-Length only checked it's a value, not that there's only one, clients could send two. Second one's rejected now.
Wasmtime GitHub notifications bot (Oct 14 2026 at 12:41):xia-chao requested rvolosatovs for a review on PR #14718.
Wasmtime GitHub notifications bot (Oct 14 2026 at 12:41):xia-chao requested wasmtime-wasi-reviewers for a review on PR #14718.
Wasmtime GitHub notifications bot (Oct 14 2026 at 12:41):xia-chao requested dicej for a review on PR #14718.
Wasmtime GitHub notifications bot (Oct 14 2026 at 12:41):xia-chao requested wasmtime-core-reviewers for a review on PR #14718.
Wasmtime GitHub notifications bot (Oct 14 2026 at 15:04)::thumbs_up: rvolosatovs submitted PR review.
Wasmtime GitHub notifications bot (Oct 14 2026 at 16:52):rvolosatovs added PR #14718 wasi-http: reject a second Content-Length field to the merge queue.
Wasmtime GitHub notifications bot (Oct 14 2026 at 16:53)::repeat: pchickey submitted PR review:
Hold
Wasmtime GitHub notifications bot (Oct 14 2026 at 16:54):pchickey removed PR #14718 wasi-http: reject a second Content-Length field from the merge queue.
Wasmtime GitHub notifications bot (Oct 15 2026 at 23:43)::thumbs_up: rvolosatovs submitted PR review.
Wasmtime GitHub notifications bot (Oct 15 2026 at 23:44):rvolosatovs submitted PR review.
Wasmtime GitHub notifications bot (Oct 19 2026 at 21:26)::cross_mark: pchickey closed without merge PR #14718.
Wasmtime GitHub notifications bot (Oct 19 2026 at 21:26):pchickey commented on PR #14718:
I rejected this PR because it was opened after we were already tracking this issue as a security issue, and the fixes, along with backports to all our supported releases, was getting worked on in private. https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j
Wasmtime GitHub notifications bot (Oct 19 2026 at 21:27):pchickey edited a comment on PR #14718:
I rejected this PR because it was opened after we were already tracking this issue as a security issue, and the fixes, along with backports to all our supported releases, was getting worked on in private. The issue is now published as https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j and the fix is landing on main in https://github.com/bytecodealliance/wasmtime/pull/14824
Last updated: Oct 31 2026 at 23:03 UTC