webtransport-go Unbounded Memory Consumption Vulnerability

A memory exhaustion vulnerability exists in webtransport-go versions prior to 0.10.0. The issue arises because closed WebTransport streams are not removed from an internal session map, preventing garbage collection of their resources. This oversight allows an attacker to create and close a large number of streams, causing unbounded memory consumption.

Impact

Exploitation of this vulnerability leads to excessive memory usage, as closed streams accumulate in the internal session map and are not properly cleaned up, causing the application to consume more memory over time.

Remediation

Users can upgrade to webtransport-go version 0.10.0 or later to address this vulnerability.