CVE-2026-21435
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.
Vendor
Product
CWE
Yayın Tarihi
2026-02-12 19:15:51
Güncelleme
2026-02-19 22:51:49
Source Identifier
security-advisories@github.com
KEV Date Added
-