webtransport-go, a WebTransport protocol implementation, lacked a mandated 1024‑byte limit for the Application Error Message field in the WT_CLOSE_SESSION capsule. This reflects a CWE‑770 weakness, illustrating resource exhaustion vulnerability. An attacker can send a capsule with an arbitrarily large error message that the implementation reads and stores entirely in memory, allowing the attacker to consume an arbitrary amount of memory on the target. The vulnerability can be leveraged to cause a denial‑of‑service by exhausting memory resources, with the severity classified as moderate (CVSS 5.3).

The flaw exists in quic-go's webtransport-go library versions 0.3.0 through 0.9.0. The issue was resolved in release 0.10.0. Administrators using any earlier version of the library should be aware that this vulnerability can be triggered by a malicious peer sending a specially crafted WT_CLOSE_SESSION capsule.

The CVSS score of 5.3 indicates moderate risk, and the EPSS is listed as less than 1 %, implying a very low likelihood of widespread exploitation. The vulnerability is not currently listed in the CISA KEV catalog. An attacker must send the full payload to trigger the memory allocation, but the lack of an upper bound makes large‑scale attacks feasible if sufficient bandwidth is available. The likely attack vector is inferred from the description as a remote peer connecting over the WebTransport protocol to the vulnerable service.