5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21434

CVE-2026-21434: webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule

webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated limit of 1024 bytes on this field, allowing a peer to send an arbitrarily large message payload that is fully read and stored in memory. This allows an attacker to consume an arbitrary amount of memory. The attacker must transmit the full payload to achieve the memory consumption, but the lack of any upper bound makes large-scale attacks feasible given sufficient bandwidth. This vulnerability is fixed in 0.10.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21434

CVE-2026-21434:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/quic-go/webtransport-go	go	>= 0.3.0, <= 0.9.0	0.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the webtransport-go library's handling of WT_CLOSE_SESSION capsules. According to the WebTransport over HTTP/3 specification, the application error message within this capsule should not exceed 1024 bytes. However, the library failed to enforce this limit.

The analysis of the patch that fixes this vulnerability, commit 89a80614cd565f6bbac6ed58b2c7207a72a10602, clearly shows the vulnerable code and the fix. The function Session.parseNextCapsule in session.go is responsible for parsing incoming capsules.

Before the patch, the code used io.ReadAll(r) to read the error message from the capsule's reader r. This reads until an EOF is encountered, meaning a remote peer could send an arbitrarily large payload, which would be buffered entirely in memory.

The fix replaces this unbounded read with io.ReadAll(io.LimitReader(r, maxCloseCapsuleErrorMsgLen)), where maxCloseCapsuleErrorMsgLen is set to 1024. This ensures that at most 1024 bytes are read for the error message, mitigating the memory exhaustion vulnerability.

Therefore, during an exploit, the Session.parseNextCapsule function would be present in the runtime profile as it processes the malicious, oversized WT_CLOSE_SESSION capsule.

Vulnerable functions

Session.parseNextCapsule

session.go

The `parseNextCapsule` function is responsible for parsing capsules from the underlying connection. When handling a `WT_CLOSE_SESSION` capsule, the vulnerable version of the code reads the entire application error message into memory without enforcing any length limits. An attacker could send a capsule with an excessively large error message, causing the application to allocate an unbounded amount of memory, which could lead to a denial of service through memory exhaustion.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.