{"id":"CVE-2026-35469","aliases":["GHSA-pc3f-x583-g7j2","GO-2026-4958"],"url":"https://o3.security/vulnerability/CVE-2026-35469","summary":"SpdyStream: DOS on CRI","details":"The SPDY/3 frame parser in spdystream does not validate\nattacker-controlled counts and lengths before allocating memory. A\nremote peer that can send SPDY frames to a service using spdystream can\ncause the process to allocate gigabytes of memory with a small number of\nmalformed control frames, leading to an out-of-memory crash.\n \nThree allocation paths in the receive side are affected:\n1. **SETTINGS entry count** -- The SETTINGS frame reader reads a 32-bit\n`numSettings` from the payload and allocates a slice of that size\nwithout checking it against the declared frame length. An attacker\ncan set `numSettings` to a value far exceeding the actual payload,\ntriggering a large allocation before any setting data is read.\n \n2. **Header count** -- `parseHeaderValueBlock` reads a 32-bit\n`numHeaders` from the decompressed header block and allocates an\n`http.Header` map of that size with no upper bound.\n \n3. **Header field size** -- Individual header name and value lengths are\nread as 32-bit integers and used directly as allocation sizes with\nno validation.\n \nBecause SPDY header blocks are zlib-compressed, a small on-the-wire\npayload can decompress into attacker-controlled bytes that the parser\ninterprets as 32-bit counts and lengths. A single crafted frame is\nenough to exhaust process memory.\n## Impact\n Any program that accepts SPDY connections using spdystream -- directly\nor through a dependent library -- is affected. A remote peer that can\nsend SPDY frames to the service can crash the process with a single\ncrafted SPDY control frame, causing denial of service.\n## Affected versions\n `github.com/moby/spdystream` <= v0.5.0\n## Fix\n v0.5.1 addresses the receive-side allocation bugs and adds related\nhardening:\n \n**Core fixes:**\n \n- **SETTINGS entry-count validation** -- The SETTINGS frame reader now\nchecks that `numSettings` is consistent with the declared frame\nlength (`numSettings <= (length-4)/8`) before allocating.\n \n- **Header count limit** -- `parseHeaderValueBlock` enforces a maximum\nnumber of headers per frame (default: 1000).\n \n- **Header field size limit** -- Individual header name and value\nlengths are checked against a per-field size limit (default: 1 MiB)\nbefore allocation.\n \n- **Connection closure on protocol error** -- The connection read loop\nnow closes the underlying `net.Conn` when it encounters an\n`InvalidControlFrame` error, preventing further exploitation on the\nsame connection.\n \n**Additional hardening:**\n \n- **Write-side bounds checks** -- All frame write methods now verify\nthat payloads fit within the 24-bit length field, preventing the\nlibrary from producing invalid frames.\n \n**Configurable limits:**\n \n- Callers can adjust the defaults using `NewConnectionWithOptions` or\nthe lower-level `spdy.NewFramerWithOptions` with functional options:\n`WithMaxControlFramePayloadSize`, `WithMaxHeaderFieldSize`, and\n`WithMaxHeaderCount`.\n ","published":"2026-04-16T21:19:23.516Z","modified":"2026-09-13T03:30:32.250543185Z","cvss":null,"epss":{"score":0.00656,"percentile":0.48195,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/moby/spdystream","fixedVersion":"0.5.1"}],"fix":{"url":"https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f","label":"moby/spdystream@ef6121f"},"references":[{"type":"WEB","url":"https://github.com/moby/spdystream/releases/tag/v0.5.1"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35469.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11070"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11217"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13829"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17121"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17123"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17449"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17475"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17599"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19108"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20034"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20042"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21658"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21692"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21697"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23235"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25046"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25187"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25194"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25201"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25207"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27010"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27903"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27914"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27983"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29801"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29835"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29857"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29858"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29865"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33071"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34050"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34755"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34766"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34769"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34794"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36162"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36621"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37187"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37193"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37387"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37580"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37581"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40022"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40023"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40828"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41019"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43227"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43253"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44237"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44267"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47728"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47729"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:51007"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:51013"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:51022"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:51422"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53655"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59557"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60023"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:63046"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-35469"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35469.json"},{"type":"ADVISORY","url":"https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35469"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457729"},{"type":"WEB","url":"https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f"},{"type":"PACKAGE","url":"https://github.com/moby/spdystream"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-13T03:30:32.250543185Z"}}