CVE-2026-21438CWE-401CWE-459

webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map

Medium · published February 12, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weaknesses
CWE-401 · Missing Release of Memory after Effective Lifetime; CWE-459 · Incomplete Cleanup
Published
2026-02-12T18:25Z
EPSS history
Timeline
  • 12 FEB 18:25Z
    webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
    cvelistv5