PT-2026-7869 · Unknown · Webtransport-Go

Marten-Seemann · Publicado 2026-02-12 · Atualizado 2026-03-03 · CVE-2026-21435

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions webtransport-go versions prior to 0.10.0

Description A malicious peer can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. Specifically, a peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT CLOSE SESSION capsule and causing the close operation to hang. The WebTransport protocol signals session termination by sending a WT CLOSE SESSION capsule on the CONNECT stream. Affected versions blocked indefinitely while waiting for sufficient QUIC flow control credit from the peer.

Recommendations Update to version 0.10.0 or later.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2026-21435

GHSA-PX4R-G4P3-HHQV

GO-2026-4488

SUSE-SU-2026:0757-1

Produtos afetados

Webtransport-Go

Referências · 118

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21435.json · Exploit
• https://github.com/quic-go/webtransport-go · Nota
• https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0 · Nota
• https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqv · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-26205 · Nota
• https://suse.com/security/cve/CVE-2026-23989 · Nota
• https://suse.com/security/cve/CVE-2017-18916 · Nota
• https://suse.com/security/cve/CVE-2023-43636 · Nota
• https://suse.com/security/cve/CVE-2026-23633 · Nota
• https://suse.com/security/cve/CVE-2026-23992 · Nota
• https://osv.dev/vulnerability/GO-2026-4488 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-26187 · Nota
• https://twitter.com/_cvereports/status/2022063259176587763 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-25882 · Nota
• https://t.me/cveNotify/152531 · Publicação no Telegram