Executive brief
webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map in github.com/quic-go/webtransport-go
Affected products
- Go github.com/quic-go/webtransport-go
Junglewise Threat Intelligence
CVE-2026-21438: GO-2026-4483 - webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map in github.com/quic-go/webtransport-go
CVE-2026-21438 · Severity: low · CVSS 3.1 · Published 2026-02-17
Technologies: github.com/quic-go/webtransport-go (Go). Vendors: Go.
Related threats
- webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknow
- GO-2026-4485 - webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule in github.com/quic-go/webtransport-go
- GO-2026-4488 - webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go