CVE-2026-21438
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| quic-go | webtransport-go | < 0.10.0 | affected |
Weaknesses
- CWE-401: CWE-401: Missing Release of Memory after Effective Lifetime
- CWE-459: CWE-459: Incomplete Cleanup
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://github.com/quic-go/webtransport-go/security/advisories/GHSA-2f2x-8mwp-p2gc
- https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.