webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1,
    Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request
    stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in
    memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory
    for the full payload; QUIC flow control does not bound the total retained allocation because reading
    advances the flow-control window while the received bytes remain in memory. The resulting memory and
    resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.
    (CVE-2026-57497)

ID	Name	Product	Family	Type	Severity
459425	Echo: github.com/quic-go/webtransport-go: security update to 0.11.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459425	Echo: github.com/quic-go/webtransport-go: security update to 0.11.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445373	SCA: security update for github.com/quic-go/webtransport-go (GHSA-g35j-m5xg-vh3q)	Tenable Cloud Security	SCA Checks	Local	medium
445373	SCA: security update for github.com/quic-go/webtransport-go (GHSA-g35j-m5xg-vh3q)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-57497

medium

Tenable Plugins

medium

medium

medium

medium