CVE-2026-21435: 
Wolfi vulnerability analysis and mitigation

CVE-2026-21435 is a denial-of-service vulnerability in the webtransport-go library (Go module github.com/quic-go/webtransport-go) that allows a malicious peer to indefinitely block WebTransport session closure. By withholding QUIC flow control credit on the CONNECT stream, an attacker can prevent the WT_CLOSE_SESSION capsule from being transmitted, causing the Session.CloseWithError operation to hang indefinitely. All versions up to and including v0.9.0 are affected; v0.10.0 contains the fix. The GitHub Advisory Database assigns a CVSS v3.1 score of 5.3 (Moderate), while Feedly's aggregated data reflects a score of 7.5 (High) (GitHub Advisory, quic-go Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). WebTransport over HTTP/3 signals session termination by sending a WT_CLOSE_SESSION capsule on the CONNECT stream; in affected versions, the closure procedure blocked indefinitely waiting for QUIC flow control credit from the peer before transmitting this capsule. A malicious peer can deliberately withhold this credit, causing the goroutine or thread executing Session.CloseWithError to hang without any timeout or fallback mechanism. The fix in v0.10.0 applies a 10ms write deadline before attempting to send the capsule; if the deadline is exceeded, the CONNECT stream is reset instead, closing the session promptly without transmitting the optional error details (GitHub Advisory, v0.10.0 Release).

Successful exploitation results in a denial-of-service condition affecting availability only — there is no confidentiality or integrity impact. A malicious peer can cause server-side goroutines to block indefinitely on session closure, potentially exhausting goroutine or connection resources over time and rendering the WebTransport service unavailable to legitimate clients. Applications built on webtransport-go that accept connections from untrusted peers are most at risk (GitHub Advisory, quic-go Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.013% (6th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be a connected peer in an active WebTransport session, limiting the attack surface to scenarios where untrusted clients can establish sessions (GitHub Advisory).

1. Establish a WebTransport session: Connect to a server running a vulnerable version of webtransport-go (≤ v0.9.0) as a WebTransport client over HTTP/3.
2. Trigger session closure: Cause the server-side application to call Session.CloseWithError (e.g., by sending malformed data or triggering an application-level error condition that initiates session teardown).
3. Withhold QUIC flow control credit: As the malicious peer, deliberately stop advertising flow control credit on the CONNECT stream, preventing the server from writing the WT_CLOSE_SESSION capsule.
4. Sustain the block: Maintain the connection without granting additional flow control credit, keeping the server goroutine blocked indefinitely on the write operation.
5. Repeat at scale: Open multiple sessions and repeat the process to exhaust server-side goroutine or connection resources, resulting in a denial-of-service condition for legitimate users (GitHub Advisory, quic-go Advisory).

• Process/Runtime: Abnormally high number of goroutines in a Go application using webtransport-go, particularly goroutines blocked on QUIC stream write operations during session closure.
• Network: Persistent QUIC connections from a peer that never advances flow control credit on the CONNECT stream; connections that remain open indefinitely without completing the WebTransport session teardown handshake.
• Logs: Application logs showing repeated or hung calls to Session.CloseWithError without completion; absence of expected WT_CLOSE_SESSION capsule transmission confirmations in debug-level QUIC logs.
• Resource Metrics: Gradual increase in memory or goroutine count on the server process without a corresponding increase in active legitimate sessions, suggesting resource exhaustion from blocked closures.

Upgrade github.com/quic-go/webtransport-go to v0.10.0 or later, which applies a 10ms write deadline when sending the WT_CLOSE_SESSION capsule and resets the CONNECT stream if the deadline is exceeded. No configuration-based workaround is available for affected versions; upgrading is the only remediation. Downstream projects that embed webtransport-go (e.g., Centrifugo) should also update their dependency accordingly (v0.10.0 Release, GitHub Advisory).

The advisory was published by maintainer marten-seemann on February 12, 2026, and was reviewed and added to the GitHub Advisory Database on the same day. Red Hat tracked the vulnerability in their CVE database as of February 13, 2026. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (quic-go Advisory, Red Hat CVE).