CVE-2026-21438: falha de média gravidade em quic-go webtransport-go
webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
quic-go · webtransport-goCVEs relacionadas — quic-go webtransport-go
No mesmo produto, das mais perigosas para as menos.
CVE-2026-57497MEDIUMwebtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesEPSS 0.5%CVE-2026-21435MEDIUMwebtransport-go CloseWithError can block indefinitelyEPSS 0.5%CVE-2026-21434MEDIUMwebtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION CapsuleEPSS 0.5%