CVE-2026-35469highCWE-770

SpdyStream: DOS on CRI

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.7%

exploitation probability

0.7%top 52% of all CVEs

observed exploitation

nono source reports it

In short

The spdystream Go library doesn't check the size of data before allocating memory when processing SPDY network frames. An attacker can send a small, specially crafted network message that expands when decompressed, forcing the server to allocate huge amounts of memory and crash.

Technical detail

The SPDY/3 frame parser in spdystream versions ≤0.5.0 fails to validate 32-bit integer counts and lengths for SETTINGS frame entries, header block counts, and individual header field sizes before memory allocation. An unauthenticated remote attacker can send a crafted SPDY control frame with compressed payload that decompresses to large values, exhausting process memory and triggering an out-of-memory denial-of-service condition.

Summary generated and translated by AI from the official description.

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

moby · spdystream

References