TI-2026-17323 Aliases CVE-2026-21438 GHSA-2f2x-8mwp-p2gc

webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map

LOW 30CWE-401Published 2026-02-12 · Updated 2026-02-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-401.

Summary

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00412 35th percentileScored 2026-11-07

Fix Fixed webtransport-go (quic-go): 0.10.0github.com/quic-go/webtransport-go (Go): 0.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
quic-go	webtransport-go	before 0.10.0	0.10.0	Patch available	CNA
—	github.com/quic-go/webtransport-go (Go)	before 0.10.0	0.10.0	Patch available	GHSA-2f2x-8mwp-p2gc

webtransport-go Vendorquic-go Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA
github.com/quic-go/webtransport-go (Go) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-2f2x-8mwp-p2gc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:quic-go:webtransport-go::::::go::*	before 0.10.0	Vulnerable	quic-go

cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:go:*:* Versions before 0.10.0 Vulnerable ·quic-go

Remediation

Fix · CNA webtransport-go (quic-go) Fixed in 0.10.0
Fix · GHSA-2f2x-8mwp-p2gc github.com/quic-go/webtransport-go (Go) Fixed in 0.10.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-21438
2026-10-03 Alias added: GHSA-2f2x-8mwp-p2gc

References

Advisory 2

Other 2

TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
TI-2026-17319 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences