Is CVE-2026-57497 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57497 being exploited in the wild.

How severe is CVE-2026-57497?

Medium severity, with a CVSS score of 5.3, published 14 September 2026.

Which products and versions are affected?

github.com/quic-go/webtransport-go (Go) <= 0.11.0, SEMVER:introduced=0,fixed=0.11.1; Quic-Go WebTransport-Go <= 0.11.0.

Is there a fix for CVE-2026-57497?

Yes. github.com/quic-go/webtransport-go (Go): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57497 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57497?

Check whether you run github.com/quic-go/webtransport-go (Go) or Quic-Go WebTransport-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57497: quic-go webtransport-go memory exhaustion in capsule parsing

Q: Is there a fix for CVE-2026-57497?

Yes. github.com/quic-go/webtransport-go (Go): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57497 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57497?

Check whether you run github.com/quic-go/webtransport-go (Go) or Quic-Go WebTransport-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57497 · Severity: medium · CVSS 5.3 · Published 2026-09-14

webtransport-go is a Go library used to implement the WebTransport protocol, which allows for high-performance communication between web clients and servers. A vulnerability in how the library handles unrecognized data packets (capsules) allows a malicious user to force the application to consume excessive amounts of memory. This can lead to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive, disrupting service for all users.

Technologies: github.com/quic-go/webtransport-go (Go). Vendors: Go.

Quick answers

Is CVE-2026-57497 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57497 being exploited in the wild.
How severe is CVE-2026-57497?: Medium severity, with a CVSS score of 5.3, published 14 September 2026.
Which products and versions are affected?: github.com/quic-go/webtransport-go (Go) <= 0.11.0, SEMVER:introduced=0,fixed=0.11.1; Quic-Go WebTransport-Go <= 0.11.0.
Is there a fix for CVE-2026-57497?: Yes. github.com/quic-go/webtransport-go (Go): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57497 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57497?: Check whether you run github.com/quic-go/webtransport-go (Go) or Quic-Go WebTransport-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/quic-go/webtransport-go (Go): upgrade to 0.11.1 or later
```
go get github.com/quic-go/webtransport-go@v0.11.1
```

Technical details

The vulnerability exists in the `Session.parseNextCapsule` function of webtransport-go. When the library encounters an unknown WebTransport capsule type on an HTTP/3 request stream, it attempts to skip it using `io.ReadAll`. Because the capsule reader is only limited by the length declared in the capsule header, a malicious peer can send a capsule with a massive payload, forcing the receiver to allocate a corresponding amount of memory. While QUIC flow control limits buffered data on the wire, it does not prevent this application-layer allocation because reading the stream advances the flow control window while the bytes are retained in memory. The issue is resolved in version 0.11.1 by using `io.Copy(io.Discard, r)` to drain unknown capsules without buffering them.

Affected products

quic-go webtransport-go <= 0.11.0

Identifiers

CVE-2026-57497
GHSA-g35j-m5xg-vh3q
GO-2026-6099

Timeline

2026-06-20: other: Pull request to fix the issue submitted
2026-07-05: patched: Version 0.11.1 released
2026-07-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.