Read the docs
TI-2026-41401 Aliases CVE-2026-57497GHSA-g35j-m5xg-vh3q

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

Priority LOW 31CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed webtransport-go (quic-go): 0.11.1github.com/quic-go/webtransport-go (Go): 0.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quic-gowebtransport-gobefore 0.11.10.11.1Patch availableCNA
—github.com/quic-go/webtransport-go (Go)before 0.11.10.11.1Patch availableGHSA-g35j-m5xg-vh3q
  • webtransport-go Vendorquic-go Affected before 0.11.1 Fixed in 0.11.1 Patch available CNA
  • github.com/quic-go/webtransport-go (Go) Vendor— Affected before 0.11.1 Fixed in 0.11.1 Patch available GHSA-g35j-m5xg-vh3q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:*:*:*——quic-go
  • cpe:2.3:a:quic-go:webtransport-go:*:*:*:*:*:*:*:* Versions — — ·quic-go

Remediation

  • Fix · CNA webtransport-go (quic-go) Fixed in 0.11.1
  • Fix · GHSA-g35j-m5xg-vh3q github.com/quic-go/webtransport-go (Go) Fixed in 0.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57497
  2. 2026-10-03 Alias added: GHSA-g35j-m5xg-vh3q

References

Other 5

  • TI-2024-14782 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVSS 3.1HIGH 7.5
  • TI-2023-24866 quic-go vulnerable to pointer dereference that can lead to panic CVSS 3.1HIGH 7.5
  • TI-2026-29554 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
  • TI-2026-17319 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVSS 3.1HIGH 7.5
  • TI-2025-37061 quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences