{"action":"Upgrade github.com/quic-go/webtransport-go to 0.11.1 or later.","affected":[{"fixed":"0.11.1","introduced":"0"}],"component":"github.com/quic-go/webtransport-go","cve_ids":["CVE-2026-57497"],"ecosystem":"Go","epss":0.00524,"exploited":false,"fixed_versions":["0.11.1"],"ghsa_id":"GHSA-g35j-m5xg-vh3q","id":"tcs_01M5KFA6276HCKYX70AFHRBR4T","modified_at":"2026-09-10T03:50:51.904067409Z","published_at":"2026-07-24T20:49:28Z","references":["https://osv.dev/vulnerability/GHSA-g35j-m5xg-vh3q","https://github.com/quic-go/webtransport-go/security/advisories/GHSA-g35j-m5xg-vh3q","https://github.com/quic-go/webtransport-go/pull/290","https://github.com/quic-go/webtransport-go/commit/3aecd11736579530ff067651c30a543eb0b4b8c4","https://github.com/quic-go/webtransport-go","https://github.com/quic-go/webtransport-go/releases/tag/v0.11.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-g35j-m5xg-vh3q","url":"https://osv.dev/vulnerability/GHSA-g35j-m5xg-vh3q"}],"summary":"webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules"}