{"id":"EUVD-2026-77618","enisaUuid":"6ee7bf17-3427-303b-8cc4-36c0c250e0df","description":"webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.","datePublished":"Sep 14, 2026, 4:05:31 PM","dateUpdated":"Sep 14, 2026, 8:06:48 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q\nhttps://github.com/quic-go/webtransport-go/pull/290\nhttps://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4\nhttps://github.com/quic-go/webtransport-go/releases/tag/v0.11.1\n","aliases":"CVE-2026-57497\nGHSA-g35j-m5xg-vh3q\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"0f720c60-90b9-358f-abed-8dc2cf1b9c5f","product":{"name":"webtransport-go","vendor":{"name":"quic-go"}},"product_version":"\u003c 0.11.1"}],"enisaIdVendor":[{"id":"9d2088da-f064-3ebe-87fc-ce2ae45795a3","vendor":{"name":"quic-go"}}],"enisaIdVulnerability":[{"id":"77d3766f-e5cf-30a5-93ac-060fe7f09739","vulnerability":{"id":"CVE-2026-57497","description":"webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.","datePublished":"Sep 14, 2026, 4:05:31 PM","dateUpdated":"Sep 14, 2026, 8:06:48 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q\nhttps://github.com/quic-go/webtransport-go/pull/290\nhttps://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4\nhttps://github.com/quic-go/webtransport-go/releases/tag/v0.11.1\n","enisa_id":"EUVD-2026-77618\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Nov 11, 2026, 7:22:07 AM","vulnerabilityProduct":[{"id":"bd66da80-63f2-34fa-8609-d3a6ad6899f3","product":{"name":"webtransport-go","vendor":{"name":"quic-go"}},"product_version":"\u003c 0.11.1"}],"vulnerabilityVendor":[{"id":"27841291-831e-3e81-ab4f-f909ae2b1aa3","vendor":{"name":"quic-go"}}]}},{"id":"e8675654-6fd8-36f0-b564-5bcc8a4f0700","vulnerability":{"id":"GHSA-g35j-m5xg-vh3q","description":"webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules","datePublished":"Jul 24, 2026, 8:49:28 PM","dateUpdated":"Jul 24, 2026, 8:49:28 PM","baseScore":0.0,"references":"https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q\nhttps://github.com/quic-go/webtransport-go/pull/290\nhttps://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4\nhttps://github.com/quic-go/webtransport-go\nhttps://github.com/quic-go/webtransport-go/releases/tag/v0.11.1\n","enisa_id":"EUVD-2026-77618\n","aliases":"GHSA-g35j-m5xg-vh3q\nCVE-2026-57497\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:50:23 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}