CVE-2026-21438: webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
Summary An attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources.
Details webtransport-go maintains an internal map tracking WebTransport streams (both unidirectional and bidirectional) belonging to a session. In affected versions, entries for closed streams were not removed from this map, causing the map to grow indefinitely as streams were created and closed.
A malicious peer can exploit this by opening large numbers of streams and closing them, leading to steady memory growth proportional to the number of closed streams.
The Fix webtransport-go now removes closed streams from the internal map upon closure. This allows the associated resources to be garbage collected, bounding memory usage to active streams only.
Other sources
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21438?
CVE-2026-21438 is classified as having high severity due to its potential for unbounded memory consumption.
How do I fix CVE-2026-21438?
To address CVE-2026-21438, update the webtransport-go package to version 0.10.0 or above.
What software is affected by CVE-2026-21438?
CVE-2026-21438 affects versions of the webtransport-go package up to and including 0.9.0.
What kind of attack does CVE-2026-21438 enable?
CVE-2026-21438 enables an attacker to exploit an unbounded memory consumption vulnerability by repeatedly creating and closing WebTransport streams.
What is the root cause of CVE-2026-21438?
The root cause of CVE-2026-21438 is the failure to remove closed WebTransport streams from an internal session map, which prevents their resources from being garbage collected.