CVE-2026-57497: CWE-770: Allocation of Resources Without Limits or Throttling in quic-go webtransport-go
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.
AI Analysis
Technical Summary
The vulnerability exists in webtransport-go before version 0.11.1 in the Session.parseNextCapsule() function. When encountering an unknown WebTransport capsule on the HTTP/3 request stream, the function calls io.ReadAll on the capsule reader, which retains the entire capsule body in memory. Since QUIC flow control advances the window as bytes are read but does not limit the total retained memory, a malicious peer can send a large unknown capsule to exhaust memory resources. This can disrupt or crash the client or server process. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and has a CVSS 3.1 base score of 5.3 (medium severity). The issue is resolved in version 0.11.1.
Potential Impact
An attacker can cause a client or server using vulnerable versions of webtransport-go to allocate excessive memory by sending large unknown capsules. This can lead to resource exhaustion, disrupting or crashing the affected process. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to webtransport-go version 0.11.1 or later, where this issue is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.11.1.
CVE-2026-57497: CWE-770: Allocation of Resources Without Limits or Throttling in quic-go webtransport-go
Description
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.
CVSS v3.1
Score 5.3medium
Affected software
quic-go
webtransport-go
pkg:golang/github.com/quic-go/webtransport-goRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in webtransport-go before version 0.11.1 in the Session.parseNextCapsule() function. When encountering an unknown WebTransport capsule on the HTTP/3 request stream, the function calls io.ReadAll on the capsule reader, which retains the entire capsule body in memory. Since QUIC flow control advances the window as bytes are read but does not limit the total retained memory, a malicious peer can send a large unknown capsule to exhaust memory resources. This can disrupt or crash the client or server process. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and has a CVSS 3.1 base score of 5.3 (medium severity). The issue is resolved in version 0.11.1.
Potential Impact
An attacker can cause a client or server using vulnerable versions of webtransport-go to allocate excessive memory by sending large unknown capsules. This can lead to resource exhaustion, disrupting or crashing the affected process. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to webtransport-go version 0.11.1 or later, where this issue is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.11.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T14:53:40.111Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa81e7d55bf5e2cf54cc38b
Added to database: 09/14/2026, 16:19:09 UTC
Last enriched: 09/14/2026, 16:32:30 UTC
Last updated: 09/15/2026, 03:11:00 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.