CVE-2026-57497: webtransport-go DOS Vulnerability

CVE-2026-57497 Overview

CVE-2026-57497 is a resource exhaustion vulnerability in webtransport-go, a Go implementation of the WebTransport protocol maintained by the quic-go project. Versions prior to 0.11.1 mishandle unknown WebTransport capsules received on the HTTP/3 request stream. The Session.parseNextCapsule() function in session.go calls io.ReadAll on the capsule reader, buffering the entire declared capsule body in memory before discarding it. A malicious peer can advertise a large unknown capsule and force a client or server to allocate memory for the full payload, exhausting available resources.

Critical Impact
A remote unauthenticated peer can trigger memory exhaustion in WebTransport clients or servers, leading to process disruption or crash.

Affected Products

webtransport-go versions prior to 0.11.1
Applications embedding the quic-go WebTransport library as a client or server
HTTP/3 services that terminate WebTransport sessions using the affected package

Discovery Timeline

2026-09-14 - CVE-2026-57497 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-57497

Vulnerability Analysis

WebTransport frames application data inside capsules on the HTTP/3 request stream. Each capsule carries a type identifier and a length-prefixed body. The protocol requires implementations to skip capsules with unrecognized types while continuing to process the stream.

In affected releases, parseNextCapsule() skips unknown capsules by invoking io.ReadAll on the limited capsule reader. io.ReadAll accumulates every byte into a single in-memory buffer sized to the declared capsule length. Because the read completes before the buffer is discarded, the peer controls how much memory the receiver commits.

The issue is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. The advisory has an EPSS probability of 0.469%.

Root Cause

QUIC flow control does not bound the total retained allocation in this code path. Reading the stream advances the flow-control window as bytes arrive, allowing the sender to transmit additional data while the received bytes remain resident in memory. The application never applies its own ceiling on capsule sizes for unknown types, so a single capsule with a large declared length translates directly into a proportional heap allocation.

Attack Vector

An attacker establishes a WebTransport session with a vulnerable peer over HTTP/3. The attacker then sends a capsule with an unknown type identifier and a large declared length. The receiver allocates a buffer sized to that length while draining the stream. Repeating the pattern across sessions or streams amplifies the memory pressure and can crash the process.

// Patch: webtransport-go session.go
// Source: https://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4
 			}
 		default:
 			// unknown capsule, skip it
-			if _, err := io.ReadAll(r); err != nil {
+			if _, err := io.Copy(io.Discard, r); err != nil {
 				return err
 			}
 		}

The fix replaces io.ReadAll with io.Copy(io.Discard, r), which streams bytes to a sink without retaining them. See the GitHub commit and pull request #290 for the complete patch.

Detection Methods for CVE-2026-57497

Indicators of Compromise

Sudden growth in resident memory (RSS) of processes that embed webtransport-go, correlated with active HTTP/3 sessions.
Out-of-memory (OOM) kills, runtime: out of memory panics, or Go allocator failures in service logs.
Repeated abnormal session terminations from a small set of remote QUIC endpoints.

Detection Strategies

Inventory Go binaries and container images for the github.com/quic-go/webtransport-go module at versions below 0.11.1 using Software Bill of Materials (SBOM) tooling or go version -m.
Instrument WebTransport servers with per-session memory and capsule-size metrics to catch anomalies before the process is killed.
Enable QUIC and HTTP/3 access logging, then alert on peers that repeatedly open sessions and terminate them with resource errors.

Monitoring Recommendations

Track heap allocation rate, go_memstats_alloc_bytes, and container memory limits for services exposing WebTransport endpoints.
Alert on OOM events at the orchestrator level, including Kubernetes OOMKilled container terminations.
Correlate memory spikes with source IP addresses in edge or load-balancer logs to identify abusive peers.

How to Mitigate CVE-2026-57497

Immediate Actions Required

Upgrade github.com/quic-go/webtransport-go to version 0.11.1 or later in all affected services and rebuild dependent binaries.
Restrict exposure of WebTransport endpoints to trusted networks until the upgrade is deployed.
Enforce per-process and per-container memory limits so that a single exploitation attempt cannot exhaust host memory.

Patch Information

The fix is available in webtransport-go v0.11.1 and is described in GitHub Security Advisory GHSA-g35j-m5xg-vh3q. The patch changes the unknown-capsule skip path in session.go from io.ReadAll to io.Copy(io.Discard, r), discarding bytes as they arrive rather than buffering the full capsule body.

Workarounds

Terminate WebTransport traffic behind a reverse proxy that caps HTTP/3 request stream sizes and rejects abnormally large frames.
Rate-limit new WebTransport sessions per source address at the edge to reduce amplification potential.
Deploy strict cgroup memory limits and automatic process restart policies to contain the blast radius of memory exhaustion.

bash

# Upgrade the vulnerable dependency in a Go module
go get github.com/quic-go/webtransport-go@v0.11.1
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/quic-go/webtransport-go