{"id":"CVE-2026-57497","title":"webtransport-go is an implementation of the WebTransport protocol","summary":"webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-770"],"vendor":"quic-go","product":"webtransport-go","affected":["webtransport-go < 0.11.1"],"patched":["github.com/quic-go/webtransport-go 0.11.1"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:16:48.567","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57497","references":[{"url":"https://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4","label":"security-advisories@github.com"},{"url":"https://github.com/quic-go/webtransport-go/pull/290","label":"security-advisories@github.com"},{"url":"https://github.com/quic-go/webtransport-go/releases/tag/v0.11.1","label":"security-advisories@github.com"},{"url":"https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-g35j-m5xg-vh3q"}],"tags":["nvd","cve.org","ghsa","go"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-14T19:22:14.262426Z"},"aliases":["GHSA-g35j-m5xg-vh3q"],"ecosystem":"go","ingestedAt":"2026-07-24T21:39:14.858Z","epss":0.00469,"epssPercentile":0.39786,"slug":"CVE-2026-57497","body":"## Overview\n\nwebtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-57497)\n\nAffected packages:\n\n- `github.com/quic-go/webtransport-go <= 0.11.0`\n\nPatched in:\n\n- `github.com/quic-go/webtransport-go 0.11.1`\n\nSource: https://github.com/advisories/GHSA-g35j-m5xg-vh3q","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}