CVE-2026-21438: 
Wolfi vulnerability analysis and mitigation

CVE-2026-21438 is a memory exhaustion vulnerability in webtransport-go, the Go implementation of the WebTransport protocol by quic-go. An unauthenticated remote attacker can cause unbounded memory consumption by repeatedly creating and closing WebTransport streams, as closed streams were never removed from an internal session map, preventing garbage collection. All versions up to and including v0.9.0 are affected; the issue was fixed in v0.10.0. The vulnerability was published on February 12, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-459 (Incomplete Cleanup). webtransport-go maintains an internal map tracking both unidirectional and bidirectional WebTransport streams per session; in affected versions, entries for closed streams were never deleted from this map, causing it to grow indefinitely. A malicious peer can exploit this by opening a large number of streams and immediately closing them, resulting in steady memory growth proportional to the total number of streams ever created. No authentication, privileges, or user interaction are required, and attack complexity is low. The fix in v0.10.0 removes closed streams from the internal map upon closure, allowing their resources to be garbage collected (GitHub Advisory, webtransport-go v0.10.0).

Successful exploitation results in unbounded memory growth on the server hosting a vulnerable webtransport-go instance, ultimately leading to service degradation or denial of service as the host exhausts available memory. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Applications relying on webtransport-go for real-time communication (e.g., gaming, streaming, or collaborative tools) could become unresponsive or crash under sustained attack (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.013% (6th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite requiring no privileges or user interaction, the low CVSS availability impact and niche deployment footprint of webtransport-go limit practical exploitation risk (GitHub Advisory).

1. Reconnaissance: Identify services using webtransport-go versions ≤ 0.9.0 by probing for WebTransport-capable endpoints (HTTP/3 CONNECT with Upgrade: websocket or WebTransport headers) using tools like curl with HTTP/3 support or custom QUIC clients.
2. Establish a WebTransport session: Connect to the target server and negotiate a WebTransport session over HTTP/3.
3. Repeatedly open and close streams: Using a custom client or script, rapidly open a large number of unidirectional or bidirectional WebTransport streams and immediately close them in a loop. Each closed stream adds an entry to the server's internal session map without ever being removed.
4. Sustain the attack: Continue the stream creation/closure loop to drive steady memory growth on the server, proportional to the total number of streams created, until the server's memory is exhausted and service is degraded or the process crashes (GitHub Advisory).

• Network: High volume of short-lived WebTransport stream open/close sequences from a single or small set of source IPs over HTTP/3 (UDP/443 or configured port); abnormally high QUIC stream creation rates in network flow data.
• Process/System: Steadily increasing memory consumption of the Go process hosting webtransport-go without a corresponding increase in active connections or application load; OOM (out-of-memory) killer events in system logs targeting the affected process.
• Logs: Application or server logs showing a large number of stream open/close events in rapid succession from the same peer address; Go runtime memory profiling (pprof) showing unbounded growth in map allocations within the session management code.

Upgrade webtransport-go to v0.10.0 or later, which removes closed streams from the internal session map upon closure and resolves the memory leak. No configuration-based workaround is available for unpatched versions; rate-limiting WebTransport stream creation at the network or application layer may reduce exposure but does not fully mitigate the issue. Operators should audit their Go module dependencies and update github.com/quic-go/webtransport-go promptly (GitHub Advisory, webtransport-go v0.10.0).