https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-21438.htmlhttps://patchthecve.com/cve/CVE-2026-21438.htmlWed, 17 Jun 2026 10:18:40 +0000MEDIUM 5.3: webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resouhttps://patchthecve.com/cve/CVE-2026-21435.htmlhttps://patchthecve.com/cve/CVE-2026-21435.htmlWed, 17 Jun 2026 10:18:40 +0000MEDIUM 5.3: webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blockinhttps://patchthecve.com/cve/CVE-2026-21434.htmlhttps://patchthecve.com/cve/CVE-2026-21434.htmlWed, 17 Jun 2026 10:18:39 +0000MEDIUM 5.3: webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message. The implementation d