Read the docs
TI-2026-17319 Aliases CVE-2026-21434GHSA-g6x7-jq8p-6q9q

webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule

Priority LOW 39CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated limit of 1024 bytes on this field, allowing a peer to send an arbitrarily large message payload that is fully read and stored in memory. This allows an attacker to consume an arbitrary amount of memory. The attacker must transmit the full payload to achieve the memory consumption, but the lack of any upper bound makes large-scale attacks feasible given sufficient bandwidth. This vulnerability is fixed in 0.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed webtransport-go (quic-go): 0.10.0github.com/quic-go/webtransport-go (Go): 0.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quic-gowebtransport-gobefore 0.10.00.10.0Patch availableCNA
—github.com/quic-go/webtransport-go (Go)0.3.0 to before 0.10.00.10.0Patch availableGHSA-g6x7-jq8p-6q9q
  • webtransport-go Vendorquic-go Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA
  • github.com/quic-go/webtransport-go (Go) Vendor— Affected 0.3.0 to before 0.10.0 Fixed in 0.10.0 Patch available GHSA-g6x7-jq8p-6q9q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:go:*:*0.3.0 to before 0.10.0Vulnerablequic-go
  • cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:go:*:* Versions 0.3.0 to before 0.10.0 Vulnerable ·quic-go

Remediation

  • Fix · CNA webtransport-go (quic-go) Fixed in 0.10.0
  • Fix · GHSA-g6x7-jq8p-6q9q github.com/quic-go/webtransport-go (Go) Fixed in 0.10.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21434
  2. 2026-10-03 Alias added: GHSA-g6x7-jq8p-6q9q

References

Advisory 2

Other 2

  • TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
  • TI-2026-17323 webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences