Vulnerability Description
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Quic-Go | Webtransport-Go | < 0.10.0 |
Related Weaknesses (CWE)
References
- https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0ProductRelease Notes
- https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhVendor Advisory
FAQ
What is CVE-2026-21435?
CVE-2026-21435 is a vulnerability with a CVSS score of 5.3 (MEDIUM). webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport se...
How severe is CVE-2026-21435?
CVE-2026-21435 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-21435?
Check the references section above for vendor advisories and patch information. Affected products include: Quic-Go Webtransport-Go.