Cloudanix VulnDB

CVE-2026-21434

Medium · 5.3

CVSS

5.3

EPSS

0.5%

Published

Feb 12, 2026

CISA due date

—

The record

webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated limit of 1024 bytes on this field, allowing a peer to send an arbitrarily large message payload that is fully read and stored in memory. This allows an attacker to consume an arbitrary amount of memory. The attacker must transmit the full payload to achieve the memory consumption, but the lack of any upper bound makes large-scale attacks feasible given sufficient bandwidth. This vulnerability is fixed in 0.10.0.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/marten-seemann/webtransport-go 0.3.0 No fix
Go github.com/quic-go/webtransport-go 0 0.10.0
Go github.com/quic-go/webtransport-go 0.3.0 0.10.0
Chainguard ipfs-cluster 0 1.1.5-r5
Chainguard ipfs-cluster-fips 0 1.1.5-r4
Chainguard k3s 0 1.35.1.1-r1
Chainguard k3s-1.32 0 1.32.13.1-r2
Chainguard k3s-1.33 0 1.33.9.1-r3
Chainguard k3s-static 0 1.35.1.1-r1
Chainguard k3s-static-1.31 0 1.31.6.1-r13
Chainguard k3s-static-1.32 0 1.32.13.1-r2
Chainguard kubo 0 0.39.0-r5
Chainguard rke2-runtime-1.31 0 1.31.14.2.1-r8
Chainguard rke2-runtime-1.32 0 1.32.12.2.1-r2
Chainguard rke2-runtime-1.33 0 1.33.8.2.1-r2
Chainguard rke2-runtime-1.34 0 1.34.4.2.1-r2
Chainguard rke2-runtime-1.35 0 1.35.1.2.1-r2
Chainguard spegel 0 0.6.0-r4
Chainguard spegel-fips 0 0.6.0-r4
Wolfi ipfs-cluster 0 1.1.5-r5
Wolfi k3s 0 1.35.1.1-r1
Wolfi k3s-1.32 0 1.32.13.1-r2
Wolfi k3s-1.33 0 1.33.9.1-r3
Wolfi k3s-static 0 1.35.1.1-r1
Wolfi k3s-static-1.32 0 1.32.13.1-r2
Wolfi kubo 0 0.39.0-r5
Wolfi spegel 0 0.6.0-r4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260226T182644-150000.1.149.1

Related vulnerabilities