Cloudanix VulnDB

CVE-2026-21435

Medium · 5.3

CVSS

5.3

EPSS

0.5%

Published

Feb 12, 2026

CISA due date

—

The record

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/quic-go/webtransport-go 0 0.10.0
Chainguard ipfs-cluster 0 1.1.5-r5
Chainguard ipfs-cluster-fips 0 1.1.5-r4
Chainguard k3s 0 1.35.1.1-r1
Chainguard k3s-1.32 0 1.32.13.1-r2
Chainguard k3s-1.33 0 1.33.9.1-r3
Chainguard k3s-static 0 1.35.1.1-r1
Chainguard k3s-static-1.31 0 1.31.6.1-r13
Chainguard k3s-static-1.32 0 1.32.13.1-r2
Chainguard kubo 0 0.39.0-r5
Chainguard rke2-runtime-1.31 0 1.31.14.2.1-r8
Chainguard rke2-runtime-1.32 0 1.32.12.2.1-r2
Chainguard rke2-runtime-1.33 0 1.33.8.2.1-r2
Chainguard rke2-runtime-1.34 0 1.34.4.2.1-r2
Chainguard rke2-runtime-1.35 0 1.35.1.2.1-r2
Chainguard spegel 0 0.6.0-r4
Chainguard spegel-fips 0 0.6.0-r4
Wolfi ipfs-cluster 0 1.1.5-r5
Wolfi k3s 0 1.35.1.1-r1
Wolfi k3s-1.32 0 1.32.13.1-r2
Wolfi k3s-1.33 0 1.33.9.1-r3
Wolfi k3s-static 0 1.35.1.1-r1
Wolfi k3s-static-1.32 0 1.32.13.1-r2
Wolfi kubo 0 0.39.0-r5
Wolfi spegel 0 0.6.0-r4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260226T182644-150000.1.149.1

Related vulnerabilities