What is CVE-2026-21438?

CVE-2026-21438 is a medium-severity vulnerability in Quic-Go Webtransport-Go, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.3/10. Published 2026-02-12.

How severe is CVE-2026-21438?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Quic-Go Webtransport-Go

CVE-2026-21438

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.

EPSS: 0.004 (29.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Quic-go Webtransport-go — versions < 0.10.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-21438?: CVE-2026-21438 is a medium-severity vulnerability in Quic-Go Webtransport-Go, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.3/10. Published 2026-02-12.
How severe is CVE-2026-21438?: Medium severity. CVSS v3 base score is 5.3 out of 10.