CVE-2026-21435: webtransport-go DoS Vulnerability

CVE-2026-21435 Overview

CVE-2026-21435 is a Denial of Service vulnerability in webtransport-go, an implementation of the WebTransport protocol built on QUIC. Prior to version v0.10.0, an attacker can cause a denial of service by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang indefinitely.

Critical Impact

Applications using affected versions of webtransport-go may experience resource exhaustion and service unavailability when targeted by malicious peers exploiting the flow control mechanism.

Affected Products

• webtransport-go versions prior to v0.10.0
• Applications and services built using the vulnerable webtransport-go library
• QUIC-based WebTransport implementations dependent on the affected code

Discovery Timeline

• February 12, 2026 - CVE-2026-21435 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21435

Vulnerability Analysis

This vulnerability (CWE-400: Uncontrolled Resource Consumption) exists in how webtransport-go handles session closure operations. The WebTransport protocol relies on the underlying QUIC connection for reliable data transmission, including the exchange of control capsules like WT_CLOSE_SESSION. When a session needs to be closed gracefully, the library attempts to send this capsule over the CONNECT stream.

The fundamental issue lies in the flow control mechanism of QUIC. Flow control prevents a sender from overwhelming a receiver by requiring the receiver to grant "credit" before data can be transmitted. A malicious peer can exploit this by simply refusing to grant flow control credit on the CONNECT stream, effectively blocking any pending writes—including the critical WT_CLOSE_SESSION capsule.

When the close operation is blocked, it hangs indefinitely waiting for the transmission to complete. This can lead to resource accumulation as sessions cannot be properly cleaned up, eventually exhausting server resources and causing denial of service conditions.

Root Cause

The root cause is the lack of a timeout or alternative completion mechanism for the session close operation. The implementation assumed that flow control credit would eventually be granted, but did not account for malicious peers deliberately withholding credit. Without a fallback path or timeout, the close operation becomes dependent on the cooperation of the remote peer, which cannot be guaranteed in adversarial scenarios.

Attack Vector

The attack can be executed over the network by any peer that has established a WebTransport connection. The attacker initiates a legitimate WebTransport session, then manipulates the QUIC flow control mechanism by not sending WINDOW_UPDATE frames for the CONNECT stream. When the server attempts to close the session, the WT_CLOSE_SESSION capsule cannot be transmitted because there is insufficient flow control credit. The close operation blocks indefinitely, and repeated exploitation can exhaust server resources.

The attack requires minimal sophistication—the attacker simply needs to establish connections and stop responding to flow control requests. No authentication bypass or special privileges are required, making this vulnerability accessible to any network peer.

Detection Methods for CVE-2026-21435

Indicators of Compromise

• Unusual accumulation of WebTransport sessions in a pending-close or hung state
• QUIC connections with stalled CONNECT streams showing zero flow control credit
• Server resource metrics indicating memory growth from unclosed sessions
• Log entries showing session close operations timing out or never completing

Detection Strategies

• Monitor for connections where flow control credit remains at zero for extended periods
• Implement alerting on WebTransport session counts exceeding normal operational thresholds
• Track the duration of session close operations and flag anomalously long closures
• Analyze QUIC connection metrics for patterns of withheld WINDOW_UPDATE frames

Monitoring Recommendations

• Deploy application performance monitoring to track session lifecycle durations
• Configure logging to capture flow control state during session operations
• Set up resource utilization alerts for services using webtransport-go
• Regularly audit connection pool metrics for signs of connection accumulation

How to Mitigate CVE-2026-21435

Immediate Actions Required

• Upgrade webtransport-go to version v0.10.0 or later immediately
• Audit applications for usage of affected webtransport-go versions
• Review and restart any services showing signs of hung sessions or resource accumulation
• Implement rate limiting on WebTransport connection establishment if not already present

Patch Information

The vulnerability has been addressed in webtransport-go version v0.10.0. The fix likely implements a timeout mechanism for the session close operation, ensuring that it completes even when flow control credit is withheld. Organizations should update their dependencies to this version as soon as possible.

For detailed information about the fix, refer to the GitHub Release for v0.10.0 and the GitHub Security Advisory GHSA-px4r-g4p3-hhqv.

Workarounds

• Implement connection timeouts at the application or infrastructure level to forcefully terminate stalled connections
• Deploy network-level protections to limit the duration of WebTransport connections from untrusted peers
• Consider implementing session limits per client to bound resource consumption from individual attackers
• If upgrading is not immediately possible, monitor aggressively and restart affected services when resource accumulation is detected

# Configuration example
# Update Go module dependencies to patched version
go get github.com/quic-go/webtransport-go@v0.10.0
go mod tidy

# Verify the updated version
go list -m github.com/quic-go/webtransport-go
# Expected output: github.com/quic-go/webtransport-go v0.10.0