WebTransport Zombie Connections: RFC 9114 Trailer Frame Triggers Permanent Stream Leak & OOM in Microsoft Edge and Chromium | Protocol RE
A malformed trailer HEADERS frame (END_STREAM=0) on a WebTransport CONNECT stream leaves quiche’s stream state machine permanently stuck: trailers_decompressed_=true but fin_received()=false, causing IsDoneReading() to return false forever. The stream is never removed from stream_map_, ShouldKeepConnectionAlive() holds the QUIC connection open, and Edge sends PING keepalives every ~15s indefinitely. A single webpage can open thousands of these zombie connections with no server-side limit, exhausting Network Service memory and crashing the browser. Both MSRC and Chrome VRP declined to track as security issues.
