webtransport-go vulnerabilities

2 known vulnerabilities in webtransport-go from Quic-go. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  webtransport-go: Uncontrolled Resource Consumption

  CVE-2026-21435Feb 12, 2026Quic-go

  webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow contr

• 7.5 High severity

  webtransport-go: Allocation of Resources Without Limits or Throttling

  CVE-2026-21434Feb 12, 2026Quic-go

  webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Applica