CVE-2026-35469
Memory Exhaustion via Unchecked Allocation in spdystream SPDY Parser
Publication date: 2026-04-16
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moby | spdystream | to 0.5.1 (exc) |
| moby | spdystream | 0.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the spdystream Go library versions 0.5.0 and below, which is used for multiplexing streams over SPDY connections. The issue arises because the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Specifically, three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes. These values are read as 32-bit integers and used directly for memory allocation without any bounds checking.
Since SPDY header blocks are compressed using zlib, a small payload on the wire can decompress into large attacker-controlled values. This allows a remote attacker who can send SPDY frames to a service using spdystream to cause the process to exhaust its memory and crash due to out-of-memory conditions with just a single crafted control frame.
This vulnerability has been fixed in version 0.5.1 of spdystream.
How can this vulnerability impact me? :
This vulnerability can lead to a denial-of-service (DoS) condition by exhausting the memory of the affected process. An attacker who can send SPDY frames to a vulnerable service can cause it to crash due to out-of-memory errors with a single crafted control frame.
Such crashes can disrupt service availability, potentially causing downtime and impacting users who rely on the affected service.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the spdystream library to version 0.5.1 or later, where the issue has been fixed.