CVE-2026-21435

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21435", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T03:00:29.275Z", "datePublished": "2026-02-12T18:22:58.098Z", "dateUpdated": "2026-02-17T15:36:08.731Z"}, "containers": {"cna": {"title": "webtransport-go CloseWithError can block indefinitely", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqv"}, {"name": "https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0"}], "affected": [{"vendor": "quic-go", "product": "webtransport-go", "versions": [{"version": "< 0.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T18:24:49.233Z"}, "descriptions": [{"lang": "en", "value": "webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0."}], "source": {"advisory": "GHSA-px4r-g4p3-hhqv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:35:59.809407Z", "id": "CVE-2026-21435", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:08.731Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21435", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:35:59.809407Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:05.195Z"}}], "cna": {"title": "webtransport-go CloseWithError can block indefinitely", "source": {"advisory": "GHSA-px4r-g4p3-hhqv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "quic-go", "product": "webtransport-go", "versions": [{"status": "affected", "version": "< 0.10.0"}]}], "references": [{"url": "https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqv", "name": "https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0", "name": "https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T18:24:49.233Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21435", "state": "PUBLISHED", "dateUpdated": "2026-02-17T15:36:08.731Z", "dateReserved": "2025-12-29T03:00:29.275Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-12T18:22:58.098Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "webtransport-go", "vendor": "quic-go", "versions": [{"status": "affected", "version": "< 0.10.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:go:*:*", "matchCriteriaId": "D64C55F6-7FB5-4D98-9E14-99F89DD9F3E4", "versionEndExcluding": "0.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0."}, {"lang": "es", "value": "webtransport-go es una implementaci\u00f3n del protocolo WebTransport. Antes de la v0.10.0, un atacante puede causar una denegaci\u00f3n de servicio en webtransport-go al impedir o retrasar indefinidamente el cierre de la sesi\u00f3n WebTransport. Un par malicioso puede retener el cr\u00e9dito de control de flujo QUIC en el flujo CONNECT, bloqueando la transmisi\u00f3n de la c\u00e1psula WT_CLOSE_SESSION y haciendo que la operaci\u00f3n de cierre se cuelgue. Esta vulnerabilidad est\u00e1 corregida en la v0.10.0."}], "id": "CVE-2026-21435", "lastModified": "2026-06-17T10:18:40.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21435", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:35:59.809407Z", "version": "2.0.3"}}]}, "published": "2026-02-12T19:15:51.503", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/quic-go/webtransport-go/security/advisories/GHSA-px4r-g4p3-hhqv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.10.0)"}}], "product": "webtransport-go", "vendor": "quic-go"}], "analysis": {"en": {"generated_at": "2026-04-17T20:03:38.860521+00:00", "value": {"mitigation_remediation": ["Upgrade webtransport-go to version 0.10.0 or later.", "If an upgrade is not immediately possible, monitor sessions for failed closure and enforce a timeout or reset connections after a defined period.", "Validate peer behavior and consider rejecting connections that exhibit abnormal flow control handling."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects quic-go\u2019s webtransport-go library. All versions prior to 0.10.0 are vulnerable; the fix is included in v0.10.0 and later releases.", "description_and_impact": "webtransport-go implements the WebTransport protocol and contains a flaw that lets an attacker cause a denial of service by preventing or indefinitely delaying the closure of a WebTransport session. The attacker can hold back QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. The effect is a stuck connection that cannot be terminated normally.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% signals a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must control a malicious peer capable of withholding QUIC flow control credit on the CONNECT stream; successful exploitation results in a session that remains open indefinitely, leading to a denial of service for the affected application."}}}}, "created": "2026-02-13T21:35:24.782848+00:00", "updated": "2026-04-17T20:15:26.991297+00:00", "vendors": ["quic-go", "quic-go$PRODUCT$webtransport-go"]}