CVE-2026-57497

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.

• CWE-770

• https://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4
• https://github.com/quic-go/webtransport-go/pull/290
• https://github.com/quic-go/webtransport-go/releases/tag/v0.11.1
• https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57480Parse Server is an open source backend that can be deployed …8.7
• CVE-2026-57481Parse Server is an open source backend that can be deployed …2.3
• CVE-2026-57485Stirling-PDF is a locally hosted web application that facili…8.5
• CVE-2026-5749Inadequate access control in the registration process in Ful…8.7
• CVE-2026-57494AgenticMail gives AI agents real email addresses and phone n…7.1
• CVE-2026-57495AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-57498Coolify is an open-source and self-hostable tool for managin…9.6
• CVE-2026-57499Liman is open source server management software. Prior to 2.…9.1
• CVE-2026-5750An insecure direct object reference (IDOR) vulnerability in …7.6
• CVE-2026-57501Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glan…0
• CVE-2026-5751justhtml versions 1.13.0 and earlier contain a parser-differ…6.1
• CVE-2026-57510SuperPlane before 0.27.0 contains a broken object-level auth…8.8