CVE-2026-35469

Fixed in a distro release EPSS <1%CVSS 8.7

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Published 2026-04-16 · CVE record · OSV

Products: moby spdystream, Red Hat OpenShift Container Platform 4.19, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Logging Subsystem for Red Hat OpenShift 6.6, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.8, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat Container Native Virtualization 4.13, Red Hat Container Native Virtualization 4.15, Red Hat Container Native Virtualization 4.16, Red Hat Container Native Virtualization 4.17, Red Hat Container Native Virtualization 4.19, Red Hat Container Native Virtualization 4.20, Red Hat Container Native Virtualization 4.21, Red Hat Container Native Virtualization 4.22, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.22, cert-manager Operator for Red Hat OpenShift, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, External Secrets Operator for Red Hat OpenShift, Red Hat Logical Volume Manager Storage, Red Hat Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenShift for Windows Containers, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat Zero Trust Workload Identity Manager

Fixed upstream

Distro releases