Homepage

Allocation of Resources Without Limits or Throttling Affecting kubo package, versions <0.42.0-r2

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.47% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KUBO-18393138
  • published30 Jul 2026
  • disclosed14 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 30 Jul 2026

CVE-2026-57497  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade Minimos:latest kubo to version 0.42.0-r2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kubo package and not the kubo package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload; QUIC flow control does not bound the total retained allocation because reading advances the flow-control window while the received bytes remain in memory. The resulting memory and resource exhaustion can disrupt or crash the affected process. This issue is fixed in version 0.11.1.