5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21435

CVE-2026-21435: webtransport-go CloseWithError can block indefinitely

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21435

CVE-2026-21435:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/quic-go/webtransport-go	go	<= 0.9.0	0.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a denial of service in webtransport-go where closing a session could block indefinitely. The fix involves adding a short deadline to the write operation that sends the session closure message. By comparing the git tags for the last vulnerable version (v0.9.0) and the first patched version (v0.10.0), I identified the commit 0187fa1fd44fde1eae9fd9804f5597a4fb3dddb8 which has the message "set a 10ms write deadline before sending the WT_CLOSE_SESSION capsule". The diff in this commit clearly shows the modification in the CloseWithError function within session.go. The original code made a blocking call to http3.WriteCapsule. The patched code introduces a 10ms deadline using SetWriteDeadline on the underlying stream before attempting to write the capsule. If the write fails (e.g., due to the deadline being exceeded), it now cancels the write on the stream instead of blocking, thus mitigating the denial of service vulnerability. Therefore, the Session.CloseWithError function is the vulnerable function.

Vulnerable functions

Session.CloseWithError

session.go

The vulnerability lies in the `CloseWithError` function, which is responsible for closing a WebTransport session. In the vulnerable version, this function would attempt to send a `WT_CLOSE_SESSION` capsule to the peer without any timeout. A malicious peer could withhold QUIC flow control credits, causing the `WriteCapsule` operation to block indefinitely, leading to a denial of service by preventing the session from closing and consuming resources.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.