CVE-2026-21438
webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map
Reported by github_m · Published February 12, 2026
github.com/quic-go/webtransport-go is fixed in 0.10.0 (Go Modules)
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/quic-go/webtransport-go | Go Modules | 0.10.0 |
| k3s-1.33 | Wolfi | 1.33.9.1-r3 |
| k3s | Chainguard | 1.35.1.1-r1 |
| rke2-runtime-1.35 | Chainguard | 1.35.1.2.1-r2 |
| spegel | Chainguard | 0.6.0-r4 |
| ipfs-cluster | Chainguard | 1.1.5-r5 |
| spegel-fips | Chainguard | 0.6.0-r4 |
| rke2-runtime-1.33 | Chainguard | 1.33.8.2.1-r2 |
| kubo | Chainguard | 0.39.0-r5 |
| k3s-1.32 | Wolfi | 1.32.13.1-r2 |
| k3s-1.31 | Chainguard | 1.31.6.1-r13 |
| k3s-1.33 | Chainguard | 1.33.9.1-r3 |
3 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| quic-go | webtransport-go | < 0.10.0 |
| quic-go | webtransport-go | 0 |
Timeline
- Feb 12, 2026 CVE Published
- Feb 12, 2026 PoC Published
- Feb 13, 2026 EPSS Score (30 in total, the first dated here)
- Feb 17, 2026 CVE Updated
- Mar 10, 2026 Security Advisory
- Mar 25, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-21438
vulnetix vdb fixes CVE-2026-21438Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-21438/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/quic-go/webtransport-go/security/advisories/GHSA-2f2x-8mwp-p2gc x_refsource_CONFIRM
- https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0 x_refsource_MISC