CVE-2026-21438: medium-severity vulnerability in quic-go webtransport-go
webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
quic-go · webtransport-goRelated CVEs — quic-go webtransport-go
In the same product, most dangerous first.
CVE-2026-57497MEDIUMwebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesEPSS 0.5%CVE-2026-21435MEDIUMwebtransport-go CloseWithError can block indefinitelyEPSS 0.5%CVE-2026-21434MEDIUMwebtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION CapsuleEPSS 0.5%