CVE-2026-57497: 
Wolfi vulnerability analysis and mitigation

CVE-2026-57497 is a memory exhaustion vulnerability in the webtransport-go Go library (package github.com/quic-go/webtransport-go) that allows a remote, unauthenticated attacker to trigger excessive memory allocation by sending unknown WebTransport capsules with large payloads. All versions up to and including v0.11.0 are affected; the issue was patched in v0.11.1. The advisory was published by maintainer marten-seemann on July 23, 2026, and added to the GitHub Advisory Database on July 24, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Security Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In Session.parseNextCapsule() within session.go, the library used io.ReadAll(r) to consume and discard unknown WebTransport capsule types on the HTTP/3 request stream. Because io.ReadAll reads the entire capsule body into memory before discarding it, a peer can declare a large capsule length and force the receiver to allocate a correspondingly large buffer. Although QUIC flow control limits the rate at which data is buffered on the wire, it does not prevent total heap allocation from growing unboundedly, since advancing the flow control window releases more data while the already-read bytes remain in memory. The fix replaces io.ReadAll(r) with io.Copy(io.Discard, r), streaming the capsule body to a discard sink without retaining it (GitHub Advisory, Fix Commit).

Successful exploitation causes denial-of-service (DoS) against any application using the vulnerable webtransport-go library, whether acting as a WebTransport client or server. A malicious or misbehaving peer can exhaust available memory, potentially crashing the process or causing severe resource exhaustion that degrades service availability. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (GitHub Advisory, Security Advisory).

1. Identify a target: Locate a service using github.com/quic-go/webtransport-go v0.11.0 or earlier that exposes a WebTransport endpoint over HTTP/3 (QUIC).
2. Establish a WebTransport session: Connect to the target's HTTP/3 endpoint and initiate a valid WebTransport session on the request stream.
3. Craft a malicious capsule: Construct a WebTransport capsule with an unknown (non-standard) capsule type identifier and a declared payload length set to a very large value (e.g., several gigabytes).
4. Send the capsule: Transmit the crafted capsule over the established session. The vulnerable Session.parseNextCapsule() function will call io.ReadAll on the capsule body reader, allocating memory proportional to the declared length as QUIC flow control windows are advanced.
5. Repeat if necessary: Send multiple such capsules in sequence or from multiple connections to accelerate memory exhaustion and trigger a crash or OOM condition on the target process (GitHub Advisory, Fix Commit).

• Network: Unusual large QUIC/HTTP3 streams from a single peer to a WebTransport endpoint; connections sending capsules with unknown type identifiers and very large declared lengths.
• Process: Rapid growth in heap memory usage of the Go process hosting the webtransport-go server or client; out-of-memory (OOM) kills or process crashes with memory-related error messages.
• Logs: Go runtime panic logs referencing session.go in parseNextCapsule; OOM killer entries in system logs (dmesg or /var/log/syslog) targeting the affected process.

Upgrade github.com/quic-go/webtransport-go to version v0.11.1 or later, which replaces io.ReadAll with io.Copy(io.Discard, r) for unknown capsule handling, eliminating the unbounded memory allocation. No configuration-based workaround is available for the vulnerable code path; upgrading is the only effective remediation. Operators should also consider rate-limiting or authenticating WebTransport connections at the network perimeter to reduce exposure until patching is complete (Release v0.11.1, Security Advisory).