webtransport-go implements the WebTransport protocol and contains a flaw that lets an attacker cause a denial of service by preventing or indefinitely delaying the closure of a WebTransport session. The attacker can hold back QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. The effect is a stuck connection that cannot be terminated normally.

The vulnerability affects quic-go’s webtransport-go library. All versions prior to 0.10.0 are vulnerable; the fix is included in v0.10.0 and later releases.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% signals a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must control a malicious peer capable of withholding QUIC flow control credit on the CONNECT stream; successful exploitation results in a session that remains open indefinitely, leading to a denial of service for the affected application.