CVE-2026-21434

Go/github.com/quic-go/webtransport-go CVE-2026-21434: medium 5.3, EPSS 0.46%

webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule

Action: Upgrade github.com/quic-go/webtransport-go to 0.10.0 or later.

go get github.com/quic-go/webtransport-go@v0.10.0

Affected

Fixed versions

Sources

• osv: GHSA-g6x7-jq8p-6q9q
• https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g6x7-jq8p-6q9q
• https://nvd.nist.gov/vuln/detail/CVE-2026-21434
• https://github.com/quic-go/webtransport-go
• https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0

CVE-2026-21434 · published 2026-02-12T15:28:52Z · modified 2026-09-10T03:50:35.012639183Z · JSON

Go/github.com/quic-go/webtransport-go CVE-2026-21434: unknown, EPSS 0.46%

webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule in github.com/quic-go/webtransport-go

Action: Upgrade github.com/quic-go/webtransport-go to 0.10.0 or later.

go get github.com/quic-go/webtransport-go@v0.10.0

Affected

Fixed versions

Sources

• osv: GO-2026-4485
• https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g6x7-jq8p-6q9q
• https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0

CVE-2026-21434 · published 2026-02-19T17:28:55Z · modified 2026-02-23T12:44:00.535972Z · JSON

Go/github.com/marten-seemann/webtransport-go CVE-2026-21434: unknown, EPSS 0.46%

webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule in github.com/quic-go/webtransport-go

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-4485#Go/github.com/marten-seemann/webtransport-go
• https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g6x7-jq8p-6q9q
• https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0

CVE-2026-21434 · published 2026-02-19T17:28:55Z · modified 2026-02-23T12:44:00.535972Z · JSON