PT-2026-7868 · Unknown · Webtransport-Go

Marten-Seemann · Published 2026-02-12 · Updated 2026-03-03 · CVE-2026-21434

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions webtransport-go versions 0.3.0 through 0.9.0

Description webtransport-go’s session implementation is susceptible to excessive memory consumption. An attacker can send a WT CLOSE SESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated 1024-byte limit on this field, allowing an attacker to send an arbitrarily large message payload that is fully read and stored in memory. This allows an attacker to consume an arbitrary amount of memory, requiring the full payload transmission to achieve the memory consumption.

Recommendations Upgrade to version 10.0.0 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-21434

GHSA-G6X7-JQ8P-6Q9Q

GO-2026-4485

SUSE-SU-2026:0757-1

Affected Products

Webtransport-Go

References · 118

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21434.json · Exploit
• https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g6x7-jq8p-6q9q · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4485 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21434 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g6x7-jq8p-6q9q · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21434 · Security Note
• https://github.com/quic-go/webtransport-go · Note
• https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0 · Note
• https://suse.com/security/cve/CVE-2026-26205 · Note
• https://suse.com/security/cve/CVE-2026-23989 · Note
• https://suse.com/security/cve/CVE-2017-18916 · Note
• https://suse.com/security/cve/CVE-2023-43636 · Note
• https://suse.com/security/cve/CVE-2026-23633 · Note
• https://suse.com/security/cve/CVE-2026-23992 · Note