webtransport-go implements the WebTransport protocol. Before version 0.10.0, a flaw allows an attacker to repeatedly open and close streams, which remain in an internal map; the closed streams are not cleaned up so garbage collection does not reclaim their memory. This results in unbounded memory growth and can exhaust the server’s heap, leading to service disruption. The weakness is an instance of improper resource management (CWE‑401) and missing cleanup of data structures (CWE‑459).

The affected product is the quic-go webtransport-go library. Any deployment using versions prior to 0.10.0 is vulnerable. Releases up to and including 0.9.x have not applied the fix.

The CVSS score of 5.3 reflects moderate severity and the EPSS score of less than 1% indicates a low but nonzero chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by making repeated WebTransport stream requests over the network; no special privileges or insider access are required. The combined risk is moderate but the impact—total memory exhaustion—can bring the service entirely to a halt. Monitoring and mitigation are recommended.