CVE-2026-21434: 
Wolfi vulnerability analysis and mitigation

CVE-2026-21434 is a memory exhaustion vulnerability in the webtransport-go library (Go module github.com/quic-go/webtransport-go) caused by a missing length check on the Application Error Message field in WT_CLOSE_SESSION capsules. Affected versions span v0.3.0 through v0.9.0; v0.10.0 contains the fix. The vulnerability was published on February 12, 2026, by maintainer marten-seemann. The GitHub Advisory Database assigns it a CVSS v3.1 score of 5.3 (Moderate), while Feedly's aggregated data reflects a score of 7.5 (High) for availability impact (GitHub Advisory, quic-go Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). The WebTransport over HTTP/3 draft specification (draft-ietf-webtrans-http3) mandates that the Application Error Message in a WT_CLOSE_SESSION capsule MUST NOT exceed 1024 bytes, but the affected versions of webtransport-go do not enforce this limit in the capsule parser. An attacker who can establish a WebTransport session can send a crafted WT_CLOSE_SESSION capsule with an arbitrarily large payload; the server reads and buffers the entire payload without bound, consuming memory proportional to the payload size. No authentication or special privileges are required — any peer capable of initiating or participating in a WebTransport session can trigger the condition (GitHub Advisory, quic-go Advisory).

Successful exploitation results in unbounded memory consumption on the affected server, leading to denial of service through memory exhaustion. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Applications embedding webtransport-go versions 0.3.0–0.9.0 that expose WebTransport endpoints to untrusted peers are at risk of process crashes or host-level resource exhaustion, potentially affecting co-located services (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.013% (0.02% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. While exploitation requires transmitting a large payload (consuming attacker bandwidth), the absence of any authentication requirement makes the attack accessible to any network-reachable peer (GitHub Advisory, quic-go Advisory).

1. Reconnaissance: Identify services using webtransport-go versions 0.3.0–0.9.0 that expose a WebTransport endpoint over HTTP/3 (UDP/443 or custom port). Tools like Shodan or active probing for QUIC/HTTP3 endpoints can assist.
2. Establish a WebTransport session: Connect to the target's WebTransport endpoint using a compliant or modified WebTransport client over HTTP/3.
3. Craft a malicious WT_CLOSE_SESSION capsule: Construct a WT_CLOSE_SESSION capsule where the Application Error Message field is set to a payload significantly exceeding 1024 bytes (e.g., several megabytes or gigabytes, limited only by available bandwidth).
4. Transmit the capsule: Send the crafted capsule to the server. The vulnerable parser reads and buffers the entire payload into memory without enforcing any size limit.
5. Achieve memory exhaustion: Repeat or scale the attack (multiple connections or a single very large payload) until the target process exhausts available memory, causing a crash or severe degradation of service (GitHub Advisory, quic-go Advisory).

• Network: Unusual large UDP flows to the service's HTTP/3 port from a single or small set of source IPs; QUIC connections that transmit abnormally large payloads during session teardown.
• Process/System: Rapid, sustained growth in memory usage of the Go process hosting webtransport-go; OOM (out-of-memory) killer events in system logs (dmesg, /var/log/syslog) referencing the affected process.
• Logs: Application logs showing repeated or abnormally large WT_CLOSE_SESSION capsule processing events; Go runtime panic or crash logs related to memory allocation failures.
• Metrics: Sudden spikes in heap memory allocation visible in Go runtime metrics (e.g., runtime.MemStats.HeapAlloc) correlated with incoming WebTransport session close events.

Upgrade github.com/quic-go/webtransport-go to v0.10.0, which enforces the draft-mandated 1024-byte limit on the Application Error Message in WT_CLOSE_SESSION capsules (PR #202). No configuration-based workaround is available in affected versions; upgrading is the only remediation. Operators should also consider rate-limiting or restricting access to WebTransport endpoints to trusted peers as a defense-in-depth measure while upgrades are applied (GitHub Release v0.10.0, GitHub Advisory).