CVE-2026-21435: Quic-Go Webtransport-Go

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.

Affected products

• Quic-Go Webtransport-Go: before 0.10.0 (fixed in 0.10.0)

Published 2026-02-12. Last modified 2026-06-17.