Unbounded Memory Consumption in WebTransport Implementation by quic-go

CVE-2026-21438

What is CVE-2026-21438?

The webtransport-go library, an implementation of the WebTransport protocol, suffers from a vulnerability that allows an attacker to induce unbounded memory consumption. This occurs when a large number of WebTransport streams are created and closed repeatedly. Due to an oversight in session management, the closed streams remain in an internal session map, which prevents their resources from being garbage collected. This leads to the potential exhaustion of system memory, adversely affecting application performance and stability. The issue has been addressed in version 0.10.0, which includes necessary fixes.

References