CVE-2026-21435 webtransport-go CloseWithError can block indefinitely
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-21435?
CVE-2026-21435 is a medium-severity vulnerability in quic-go webtransport-go, published on 12 Feb 2026.
Official description
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.
Weakness: CWE-400
Which versions are affected by CVE-2026-21435?
3 open source packages ship an affected version, including github.com/quic-go/webtransport-go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/quic-go/webtransport-go Go | All versions | 0.10.0 |
github.com/quic-go/webtransport-go Go | All versions | 0.10.0 |
github.com/quic-go/webtransport-go Go | All versions | 0.10.0 |
Products include Quic-Go Webtransport-Go.
How do I fix CVE-2026-21435?
Upgrade github.com/quic-go/webtransport-go to 0.10.0 or later.
Is CVE-2026-21435 being exploited?
There is no known exploitation of CVE-2026-21435 in the wild and no public exploit code.
Other vulnerabilities in quic-go webtransport-go
Sources
Also known as GHSA-px4r-g4p3-hhqv, GO-2026-4488, MINI-7v4c-m83q-mv84, MINI-j8jp-fhv4-h367.