WebTransport Protocol Vulnerability in webtransport-go by QUIC
CVE-2026-57497

5.3MEDIUM

Key Information:

Vendor: Quic-go
Status: Webtransport-go
Vendor: CVE Published:; 14 September 2026

What is CVE-2026-57497?

A vulnerability in webtransport-go, prior to version 0.11.1, allows a malicious actor to exploit the Session.parseNextCapsule() method. This issue arises due to the method skipping over an unknown WebTransport capsule while reading the entirety of the declared capsule body into memory. As a result, if a large unknown capsule is sent by a malicious peer, it can lead to significant memory and resource allocation issues for both clients and servers. The flow control mechanism of QUIC does not impose limits on total retained allocations, leading to a risk of process disruption or crash due to memory exhaustion. A fix is implemented in version 0.11.1, mitigating this risk.