Junglewise Threat Intelligence

CVE-2026-21435: GO-2026-4488 - webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go

CVE-2026-21435 · Severity: low · CVSS 3.1 · Published 2026-02-17

Technologies: github.com/quic-go/webtransport-go (Go). Vendors: Go.

Executive brief

webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go

Affected products

Go github.com/quic-go/webtransport-go

Related threats

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknow
GO-2026-4485 - webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule in github.com/quic-go/webtransport-go
GO-2026-4483 - webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map in github.com/quic-go/webtransport-go