Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-21435 webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or ind… https://www.cve.org/CVERecord?id=CVE-2026-21435
Post summary
A denial‑of‑service flaw exists in webtransport‑go before v0.10.0, but no proof of concept, exploit code, active exploitation, or patch information is provided.
CVE-2026-21435: The Infinite Goodbye: Choking WebTransport with Flow Control In the world of async networking, shutting down a connection is supposed to be a graceful handshake. But for `webtransport-go` prior to v0.10.0, it became a death grip. A vul... https://cvereports.com/reports/CVE-2026-21435
Post summary
The post announces CVE‑2026‑21435, detailing a denial‑of‑service flaw in webtransport‑go caused by improper flow‑control handling before version 0.10.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | quic-go | webtransport-go | - | go | - |