CVE-2026-21438
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 3.9 / Impact: 1.4
Source: security-advisories@github.com (Secondary)
Description
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
Affected (1)
Products: Quic Go: Webtransport Go
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 0.10.0 |
Related CWEs
CWE-401
Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CWE-459
Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
References (2)
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
Vendor Advisory
Timeline
No history available yet.