CVE-2026-57497: webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead to memory exhaustion.
References
- github.com/advisories/GHSA-g35j-m5xg-vh3q
- github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4
- github.com/quic-go/webtransport-go/pull/290
- github.com/quic-go/webtransport-go/releases/tag/v0.11.1
- github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q
- nvd.nist.gov/vuln/detail/CVE-2026-57497
Code Behaviors & Features
Detect and mitigate CVE-2026-57497 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →