CVE-2026-21435: medium-severity vulnerability in quic-go webtransport-go
webtransport-go CloseWithError can block indefinitely
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
quic-go · webtransport-goRelated CVEs — quic-go webtransport-go
In the same product, most dangerous first.
CVE-2026-57497MEDIUMwebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesEPSS 0.5%CVE-2026-21434MEDIUMwebtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION CapsuleEPSS 0.5%CVE-2026-21438MEDIUMwebtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams MapEPSS 0.4%