webtransport-go Denial-of-Service Vulnerability via Flow Control Credit Withholding

A denial-of-service vulnerability has been identified in webtransport-go, an implementation of the WebTransport protocol, in versions prior to v0.10.0. The issue arises when a malicious peer withholds QUIC flow control credit on the CONNECT stream, preventing the transmission of the WT_CLOSE_SESSION capsule, which is essential for properly closing a WebTransport session. As a result, the session closure operation can hang indefinitely.

Impact

Exploitation of this vulnerability leads to an indefinite blockage in the WebTransport session closure process, causing a denial-of-service condition.

Remediation

Users can upgrade to webtransport-go version v0.10.0 or later to address this vulnerability.