CVE-2026-21435CWE-400

webtransport-go CloseWithError can block indefinitely

Medium · published February 12, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00465 · 39.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-02-12T18:22Z
EPSS history
Timeline
  • 12 FEB 18:22Z
    webtransport-go CloseWithError can block indefinitely
    cvelistv5