GHSA-px4r-g4p3-hhqv

Source

https://github.com/advisories/GHSA-px4r-g4p3-hhqv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-px4r-g4p3-hhqv/GHSA-px4r-g4p3-hhqv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-px4r-g4p3-hhqv

Aliases

Downstream

CGA (44)

MINI (2)

Published

2026-02-12T15:29:01Z

Modified

2026-09-10T03:50:59Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

webtransport-go: CloseWithError can block indefinitely

Details

Summary

An attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang.

Details

WebTransport over HTTP/3 signals session termination by sending a WT_CLOSE_SESSION capsule on the CONNECT stream. The capsule is only needed to transmit a reason phrase and an error code to the peer. After the capsule is sent, the CONNECT stream is closed. In affected versions, the closure procedure blocked indefinitely while waiting for sufficient QUIC flow control credit from the peer. A malicious peer can withhold this credit, preventing the capsule from being sent.

The Fix

webtransport-go now attempts to send the WT_CLOSE_SESSION capsule with a short deadline. If the capsule cannot be sent within this deadline, the CONNECT stream is reset instead. This closes the WebTransport session promptly without transmitting the optional error details. This prevents indefinite blocking on session closure.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-12T15:29:01Z",
    "nvd_published_at":  "2026-02-12T19:15:51Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/quic-go/webtransport-go

Package

Name: github.com/quic-go/webtransport-go; View open source insights on deps.dev
Purl: pkg:golang/github.com/quic-go/webtransport-go

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.10.0

Database specific

last_known_affected_version_range

"<= 0.9.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-px4r-g4p3-hhqv/GHSA-px4r-g4p3-hhqv.json"