5.3

CVE-2026-57497: webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

Deferred
AliasesCGA-2frq-c4hg-qfp6CGA-3r36-p33w-wj5cCGA-442x-ch4x-j688
Published 14-09-2026Last modified 14-09-2026

Vulnerability summary

CVE-2026-57497 is a medium (CVSS 5.3) vulnerability in quic-go webtransport-go. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 44.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:21761-1SUSE-SU-2026:23625-1CGA-H7PF-W6Q5-F5JR

Timeline

  1. 14-09-2026
    PublishedVulnerability first disclosed.
  2. 14-09-2026
    Last modifiedVulnerability information updated.

Description

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard28 products
  • ipfs-cluster< 1.1.6-r11 | < 1.1.6-r18
  • ipfs-cluster-fips< 1.1.6-r11
  • k3s< 1.36.2.1-r8
  • k3s-1.31All versions (No fix recorded)
  • k3s-1.32All versions (No fix recorded)
Wolfi14 products
  • ipfs-cluster< 1.1.6-r11 | < 1.1.6-r18
  • k3s< 1.36.2.1-r8
  • k3s-1.32All versions (No fix recorded)
  • k3s-1.33< 1.33.13.1-r2
  • k3s-1.34< 1.34.9.1-r7
Github.com/quic-go1 product
  • webtransport-go< 0.11.1
Quic-go1 product

4 vendors · 44 products

References

5 links