CVE-2026-57497— webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
Quick assessment
Affected
quic-go webtransport-go
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
webtransport-go 是 WebTransport 协议的一种实现。在 0.11.1 版本之前， 中的 函数在处理 HTTP/3 请求流中遇到的未知 WebTransport 数据囊（capsule）时，会通过调用 将整个数据囊读取器读完，从而将完整声明的数据囊正文保留在内存中。恶意对端可以发送一个大的未知数据囊，导致客户端或服务器为完整载荷分配内存；由于 QUIC 流控不会限制总保留分配量（因为读取操作会推进流控窗口，而已接收的字节仍保留在内存中），由此产生的内存和资源耗尽可能会扰乱或导致受影响的进程崩
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| quic-go | webtransport-go | < 0.11.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57497
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
Source: CVE Program / CVE List V5
Vulnerability Description
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| quic-go | webtransport-go | < 0.11.1 | - |
|
II. Public POCs for CVE-2026-57497
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57497
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57497 (2)
Vendor Advisories for CVE-2026-57497 (1)
Vendor Pages for CVE-2026-57497 (1)
-
🔗 Release v0.11.1 · quic-go/webtransport-go · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: quic-go
-
CVE-2026-40898
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion -
CVE-2026-21438
webtransport-go affected by a Memory Exhaustion Attack due t -
CVE-2026-21435
webtransport-go CloseWithError can block indefinitely -
CVE-2026-21434
webtransport-go affected by Memory Exhaustion Attack due to -
CVE-2025-64702
quic-go HTTP/3 QPACK Header Expansion DoS
Same weakness: CWE-770
-
CVE-2026-13260
Security vulnerabilities have been addressed in IBM Verify I -
CVE-2026-54247
Skipper: Unbounded Request Body Read in Admission Webhook Ca -
CVE-2026-91080
webhook through 2.8.3 Memory Exhaustion via Oversized Reques -
CVE-2026-50276
dd-trace-rb: Improper parsing of W3C baggage headers may lea -
CVE-2026-50270
dd-trace-java: Improper parsing of W3C baggage headers may l
V. Comments for CVE-2026-57497
No comments yet