CVE-2026-21438

{"id": "CVE-2026-21438", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21438", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:38:58.113284Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "quic-go", "product": "webtransport-go", "versions": [{"status": "affected", "version": "< 0.10.0"}]}]}], "published": "2026-02-12T19:15:51.677", "references": [{"url": "https://github.com/quic-go/webtransport-go/releases/tag/v0.10.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/quic-go/webtransport-go/security/advisories/GHSA-2f2x-8mwp-p2gc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-401"}, {"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0."}, {"lang": "es", "value": "webtransport-go es una implementaci\u00f3n del protocolo WebTransport. Antes de la versi\u00f3n 0.10.0, un atacante pod\u00eda causar un consumo de memoria ilimitado creando y cerrando repetidamente muchas transmisiones WebTransport. Las transmisiones cerradas no se eliminaban de un mapa de sesi\u00f3n interno, lo que imped\u00eda la recolecci\u00f3n de basura de sus recursos. Esta vulnerabilidad est\u00e1 corregida en la v0.10.0."}], "lastModified": "2026-06-17T10:18:40.410", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "D64C55F6-7FB5-4D98-9E14-99F89DD9F3E4", "versionEndExcluding": "0.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}