CVE-2026-21435 MEDIUM

CVE-2026-21435: webtransport-go CloseWithError can block indefinitely

Vendor Quic-Go

Product webtransport-go

Weakness CWE-400

Published February 12, 2026

Last update February 17, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.

Key dates

02Disclosure timeline

February 12, 2026 CVE published

February 17, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-21435 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/400.html