Vulnerability Information Title: Memory Exhaustion Attack due to Missing Cleanup of Streams Map Severity: Moderate (5.3/10) CVE ID: CVE-2026-21438 Weaknesses: CWE-401, CWE-459 Affected Versions <=v0.9.0 Patched Versions v0.10.0 Description Summary: Attackers can cause unbounded memory consumption by repeatedly creating and closing WebTransport streams. Closed streams were not removed from the session map, preventing garbage collection. Details: The internal session map tracking WebTransport streams did not remove closed streams, leading to memory exhaustion. Fix: Closed streams are now removed from the internal map. CVSS v3 Base Metrics Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low CVSS Score 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L