CVE-2026-57497

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57497
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57497.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57497
Aliases
Downstream
Related
Published
2026-09-14T16:05:31Z
Modified
2026-09-15T11:30:44Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
Details

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57497.json"
}
References

Affected packages

Git / github.com/quic-go/webtransport-go

Affected ranges

Type
GIT
Repo
https://github.com/quic-go/webtransport-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d03fbc34952e05e833ab2a3810ab55aeefe2bf30
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.11.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.1.0
v0.10.0
v0.11.0
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57497.json"