CVE-2026-57497
Received Received - Intake

Memory Exhaustion in webtransport-go via Unknown Capsule

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57497
EUVD
EUVD-2026-77618

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quic-go webtransport-go to 0.11.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in the webtransport-go library (versions <= 0.11.0). It occurs when the Session.parseNextCapsule() function processes an unknown WebTransport capsule by buffering its entire payload in memory using io.ReadAll. A malicious peer can send a large unknown capsule, causing the client or server to allocate excessive memory. The retained payload is not bounded by QUIC flow control, leading to potential crashes or disruptions.

Detection Guidance

Detecting this vulnerability requires checking the version of webtransport-go in use. Run 'go list -m github.com/quic-go/webtransport-go' to verify if the installed version is below 0.11.1. Monitor for unusual memory usage spikes or crashes in applications using this library.

Impact Analysis

This vulnerability can cause denial-of-service (DoS) conditions by exhausting system memory. Attackers can send large unknown capsules to crash the affected process or disrupt services relying on the webtransport-go library. Systems using versions <= 0.11.0 are vulnerable.

Compliance Impact

This vulnerability primarily causes memory exhaustion and denial-of-service conditions, which could indirectly impact compliance with standards like GDPR or HIPAA by disrupting service availability or causing data processing failures. However, the CVE data does not provide direct information about compliance impacts or specific regulatory violations.

Mitigation Strategies

Upgrade webtransport-go to version 0.11.1 or later immediately. Replace any usage of io.ReadAll for unknown capsule handling with io.Copy(io.Discard, r) in your codebase. Ensure QUIC connections are properly closed to prevent resource leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart