CVE-2026-57497

Name of the Vulnerable Software and Affected Versions webtransport-go (affected versions not specified)

Description An attacker can trigger a denial-of-service (DoS) by sending an unknown WebTransport capsule with a large payload. The software fails to properly handle unknown capsules by reading the entire body into memory using io.ReadAll instead of draining the data. Because the capsule reader is limited only by the declared length, a malicious peer can cause excessive memory allocation, leading to resource exhaustion or system crashes. While QUIC flow control limits buffered data, it does not prevent this allocation because reading the stream advances the flow control window while the bytes are retained in memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.