Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-21438 webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing… https://www.cve.org/CVERecord?id=CVE-2026-21438
Post summary
CVE-2026-21438 in webtransport-go causes unbounded memory consumption before v0.10.0, which is mitigated in that release.
CVE-2026-21438: The Zombie Stream Apocalypse: Analyzing CVE-2026-21438 in webtransport-go A comprehensive analysis of a memory exhaustion vulnerability in the `webtransport-go` library. By failing to remove closed streams from an internal tracking map... https://cvereports.com/reports/CVE-2026-21438
Post summary
The article provides a technical analysis of a memory exhaustion flaw in webtransport-go, without discussing exploits, patches, or active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | quic-go | webtransport-go | - | go | - |