CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
A malicious peer can cause memory exhaustion and crash the process by sending large unknown WebTransport capsules in the webtransport-go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57497?
CVE-2026-57497 is a medium-severity denial of service vulnerability in quic-go webtransport-go, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-57497?
3 open source packages ship an affected version, including github.com/quic-go/webtransport-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/quic-go/webtransport-go Go | All versions | 0.11.1 |
github.com/quic-go/webtransport-go Go | All versions | 0.11.1 |
github.com/quic-go/webtransport-go Go | All versions | 0.11.1 |
How do I fix CVE-2026-57497?
Upgrade github.com/quic-go/webtransport-go to 0.11.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-57497 being exploited?
There is no known exploitation of CVE-2026-57497 in the wild and no public exploit code.
Sources
Also known as ECHO-8ef3-5c8a-bcd5, GHSA-g35j-m5xg-vh3q, GO-2026-6099, MINI-5hm4-rwcx-j54q, MINI-6pfh-343q-45x2, MINI-6xrx-4cgv-5x7x and 9 more.