CVE-2026-21435

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
quic-go	webtransport-go	< 0.10.0

References

https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0Product, Release Notes
https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqvVendor Advisory

Timeline

Published: Feb 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-214365.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `CVE-2026-214375.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tr CVE-2026-214385.3webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repea CVE-2026-214395.3badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker ma CVE-2026-21448.1The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This CVE-2026-214409.2AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker CVE-2026-214417.5urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by read CVE-2026-214436.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` CVE-2026-214445.5libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly use CVE-2026-214459.1Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints CVE-2026-214469.8Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after ini CVE-2026-214477.1Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the cust