https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:23:21 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-57497 <p>webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.</p> <p>webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-57497 https://vulnerability.circl.lu/vuln/ghsa-g35j-m5xg-vh3q <p><strong>Affected:</strong> Go: github.com/quic-go/webtransport-go</p> <p>## Summary</p> <p>An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead to memory exhaustion.</p> <p>## Impact</p> <p>A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against webtransport-go clients or servers by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion.</p> <p>## Details</p> <p>WebTransport sessions use capsules on the HTTP/3 request stream. Unknown capsule types are ignored, but the capsule body still needs to be consumed before the next capsule can be parsed.</p> <p>webtransport-go used `io.ReadAll` when skipping unknown capsules. Since the capsule reader is only limited by the capsule&#39;s declared length, a peer could send a large unknown capsule and cause the receiver to allocate memory for the full capsule body.</p> <p>QUIC flow control limits buffered data, but it does not bound total allocation here, since reading the stream advances the flow control window while retaining the received bytes in memory.</p> <p>## The Fix</p> <p>webtransport-go now drains unknown capsules to `io.Discard` instead of buffering them. This consumes the capsule body so parsing can continue, without retaining the payload in memory.</p> <p><strong>Affected:</strong> Go: github.com/quic-go/webtransport-go</p> <p>## Summary</p> <p>An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead to memory exhaustion.</p> <p>## Impact</p> <p>A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against webtransport-go clients or servers by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion.</p> <p>## Details</p> <p>WebTransport sessions use capsules on the HTTP/3 request stream. Unknown capsule types are ignored, but the capsule body still needs to be consumed before the next capsule can be parsed.</p> <p>webtransport-go used `io.ReadAll` when skipping unknown capsules. Since the capsule reader is only limited by the capsule&#39;s declared length, a peer could send a large unknown capsule and cause the receiver to allocate memory for the full capsule body.</p> <p>QUIC flow control limits buffered data, but it does not bound total allocation here, since reading the stream advances the flow control window while retaining the received bytes in memory.</p> <p>## The Fix</p> <p>webtransport-go now drains unknown capsules to `io.Discard` instead of buffering them. This consumes the capsule body so parsing can continue, without retaining the payload in memory.</p> https://vulnerability.circl.lu/vuln/ghsa-g35j-m5xg-vh3q