Memory Consumption Vulnerability in webtransport-go by quic-go

CVE-2026-21434

What is CVE-2026-21434?

The webtransport-go implementation of the WebTransport protocol suffers from a vulnerability that allows an attacker to exploit the session implementation by sending a WT_CLOSE_SESSION capsule with an excessively large Application Error Message. This oversight results from the lack of enforcement on the draft-mandated limit of 1024 bytes for this field, enabling an attacker to send arbitrarily large message payloads. Consequently, this can lead to excessive memory consumption as the implementation reads and stores the full payload in memory. The exploit allows for potential large-scale attacks if the attacker has sufficient bandwidth. Users are encouraged to update to version 0.10.0 or later to mitigate this risk.

References