CVE-2026-35469

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35469
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-35469.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-35469
Aliases
Downstream
AZL (12)
BELL (1)
CGA (984)
CLEANSTART (141)
DEBIAN (1)
MINI (217)
OESA (2)
openSUSE (8)
RHSA (4)
ROOT (1)
SUSE (19)
UBUNTU (1)
Related
openSUSE (8)
SUSE (19)
Published
2026-04-16T21:19:23Z
Modified
2026-10-22T10:32:12Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SpdyStream: DOS on CRI
Details

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35469.json"
}
References

Affected packages

Git / github.com/moby/spdystream

Affected ranges

Type
GIT
Repo
https://github.com/moby/spdystream
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c59e5d73daa301bde452ea77545bdf51e32554a2
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.5.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "original_tag": "v0.5.1",
            "range": [
                {
                    "fixed": "c59e5d73daa301bde452ea77545bdf51e32554a2"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-35469.json"