Riskcovery

CVE-2026-21438

webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map

State
Published
Severity
5.3 Medium
Published
Feb 12, 2026
Updated
Feb 17, 2026
Reserved
Dec 29, 2025

Read the record on cve.org

Description

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LGitHub_M

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime
  • CWE-459 Incomplete Cleanup

Affected Products

ProductVersions
webtransport-goquic-go
  • < 0.10.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.