CVE-2026-21438Medium· 5.3▾ Sunlitwebtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
An attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources.
webtransport-go maintains an internal map tracking WebTransport streams (both unidirectional and bidirectional) belonging to a session. In affected versions, entries for closed streams were not removed from this map, causing the map to grow indefinitely as streams were created and closed.
A malicious peer can exploit this by opening large numbers of streams and closing them, leading to steady memory growth proportional to the number of closed streams.
webtransport-go now removes closed streams from the internal map upon closure. This allows the associated resources to be garbage collected, bounding memory usage to active streams only.
github.com/quic-go/webtransport-go < 0.10.0Upgrade to a patched release:
github.com/quic-go/webtransport-go 0.10.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-46239High· 7.5quic-go vulnerable to pointer dereference that can lead to panic
CVE-2025-59530High· 7.5quic-go: Panic occurs when queuing undecryptable packets after handshake completion
CVE-2026-40898Medium· 5.3quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
CVE-2026-57497Medium· 5.3webtransport-go is an implementation of the WebTransport protocol