CVE-2026-35469
ADVISORY - githubSummary
The SPDY/3 frame parser in spdystream does not validate attacker-controlled counts and lengths before allocating memory. A remote peer that can send SPDY frames to a service using spdystream can cause the process to allocate gigabytes of memory with a small number of malformed control frames, leading to an out-of-memory crash. Three allocation paths in the receive side are affected:
- SETTINGS entry count -- The SETTINGS frame reader reads a 32-bit
numSettingsfrom the payload and allocates a slice of that size without checking it against the declared frame length. An attacker can setnumSettingsto a value far exceeding the actual payload, triggering a large allocation before any setting data is read. - Header count --
parseHeaderValueBlockreads a 32-bitnumHeadersfrom the decompressed header block and allocates anhttp.Headermap of that size with no upper bound. - Header field size -- Individual header name and value lengths are read as 32-bit integers and used directly as allocation sizes with no validation.
Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into attacker-controlled bytes that the parser interprets as 32-bit counts and lengths. A single crafted frame is enough to exhaust process memory.
Impact
Any program that accepts SPDY connections using spdystream -- directly or through a dependent library -- is affected. A remote peer that can send SPDY frames to the service can crash the process with a single crafted SPDY control frame, causing denial of service.
Affected versions
github.com/moby/spdystream <= v0.5.0
Fix
v0.5.1 addresses the receive-side allocation bugs and adds related hardening: Core fixes:
- SETTINGS entry-count validation -- The SETTINGS frame reader now
checks that
numSettingsis consistent with the declared frame length (numSettings <= (length-4)/8) before allocating. - Header count limit --
parseHeaderValueBlockenforces a maximum number of headers per frame (default: 1000). - Header field size limit -- Individual header name and value lengths are checked against a per-field size limit (default: 1 MiB) before allocation.
- Connection closure on protocol error -- The connection read loop
now closes the underlying
net.Connwhen it encounters anInvalidControlFrameerror, preventing further exploitation on the same connection.
Additional hardening:
- Write-side bounds checks -- All frame write methods now verify that payloads fit within the 24-bit length field, preventing the library from producing invalid frames.
Configurable limits:
- Callers can adjust the defaults using
NewConnectionWithOptionsor the lower-levelspdy.NewFramerWithOptionswith functional options:WithMaxControlFramePayloadSize,WithMaxHeaderFieldSize, andWithMaxHeaderCount.
Common Weakness Enumeration (CWE)
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling
NIST
-
CVSS SCORE
8.7highGitHub
-
CVSS SCORE
8.7highAlpine
-
Debian
-
Ubuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-v7gj-rrxh-8985
-
minimos
MINI-24h3-xc58-4q2g
-
minimos
MINI-27g5-vjcj-g8r7
-
minimos
MINI-2cp2-vjhc-x5f3
-
minimos
MINI-2hv6-2px8-982q
-
minimos
MINI-343j-7vr2-3298
-
minimos
MINI-3745-j6ww-8h89
-
minimos
MINI-3hmq-pgvq-5r3f
-
minimos
MINI-3vv7-2cw8-c3mh
-
minimos
MINI-42gr-7q29-qxwj
-
minimos
MINI-4fx2-gc5q-8q2f
-
minimos
MINI-4jjx-pfgg-9mhr
-
minimos
MINI-4jpp-grv3-hjc8
-
minimos
MINI-4p36-p7cw-hf6p
-
minimos
MINI-54qv-rj3m-75wm
-
minimos
MINI-564m-hx4w-5pqh
-
minimos
MINI-58vc-r9w4-v596
-
minimos
MINI-5c62-2jg7-w98w
-
minimos
MINI-5f69-m3x2-jx35
-
minimos
MINI-5fwc-v6h3-8f22
-
minimos
MINI-5jc6-4pvq-9rg2
-
minimos
MINI-5qh5-mg9m-xxg8
-
minimos
MINI-5qmc-wwg8-39q8
-
minimos
MINI-5rjg-vq92-4p85
-
minimos
MINI-693c-85q8-37hf
-
minimos
MINI-69p7-fwqv-jqpg
-
minimos
MINI-6jq2-f9r2-6hvg
-
minimos
MINI-6mc6-4v46-74h9
-
minimos
MINI-6p2p-gwx7-ghgh
-
minimos
MINI-6phw-c5f8-4548
-
minimos
MINI-7838-vpfj-29rh
-
minimos
MINI-79f9-mchx-cg6j
-
minimos
MINI-7gw5-j76f-pwwr
-
minimos
MINI-7jf7-2c4p-qrg9
-
minimos
MINI-7m25-3m5v-qfww
-
minimos
MINI-7p2f-4hq8-6rcq
-
minimos
MINI-7vxh-fx3m-4qrj
-
minimos
MINI-84mp-668x-jmgg
-
minimos
MINI-8c4h-988h-f9p6
-
minimos
MINI-8f73-8qhw-c5f5
-
minimos
MINI-8g62-f24w-mj8q
-
minimos
MINI-8hv2-2cqw-95j4
-
minimos
MINI-8xwg-5gwv-4vm2
-
minimos
MINI-92vg-fjj2-3pvv
-
minimos
MINI-9f76-25j3-vwwr
-
minimos
MINI-9gqm-wc76-547p
-
minimos
MINI-9h5w-mrf8-59pf
-
minimos
MINI-9wmc-75f4-m424
-
minimos
MINI-c2wq-3xfc-gch3
-
minimos
MINI-c72c-vgv5-826p
-
minimos
MINI-cc3f-2956-4cf5
-
minimos
MINI-cfcj-wrjf-3pw6
-
minimos
MINI-cp2j-8jc4-c2m2
-
minimos
MINI-f7hg-6wv2-q5qh
-
minimos
MINI-f94m-782v-76qh
-
minimos
MINI-fc99-qcg4-hqfv
-
minimos
MINI-ffrr-5hx7-94x8
-
minimos
MINI-fhv5-5g93-p9f5
-
minimos
MINI-fm4w-c3p5-gqcj
-
minimos
MINI-fp6f-cm77-8jxv
-
minimos
MINI-fr9p-8wqg-hvhq
-
minimos
MINI-g7vh-m6w5-733r
-
minimos
MINI-g892-3jv5-6q5r
-
minimos
MINI-g8c4-xf8p-3r5g
-
minimos
MINI-gch7-hrcg-8wcf
-
minimos
MINI-ggp9-f74g-22w2
-
minimos
MINI-gh7q-wgpg-vrgf
-
minimos
MINI-gq3r-hmr2-qggm
-
minimos
MINI-h47p-25f5-c533
-
minimos
MINI-h573-h3xr-gf7f
-
minimos
MINI-h5j7-37p3-c97r
-
minimos
MINI-h6r2-923x-h9fc
-
minimos
MINI-hpgj-h5g6-gx86
-
minimos
MINI-j5c3-vjmg-pr3w
-
minimos
MINI-j5w3-6rp5-pqxr
-
minimos
MINI-j8cx-25pc-x33v
-
minimos
MINI-j9jc-65wf-q79j
-
minimos
MINI-jh3v-f8q2-pm57
-
minimos
MINI-jhc9-q2wf-9mq8
-
minimos
MINI-jhgr-c3v9-4qh5
-
minimos
MINI-jjc8-62qr-2cw5
-
minimos
MINI-jjc9-m7c4-p47x
-
minimos
MINI-jp52-65rq-68c6
-
minimos
MINI-jwmw-7m6v-gr9q
-
minimos
MINI-m386-83ff-p2g7
-
minimos
MINI-m832-276p-cpq4
-
minimos
MINI-m845-mpmc-6f48
-
minimos
MINI-mc2m-q9c5-85xq
-
minimos
MINI-mc8p-7c94-6prg
-
minimos
MINI-mp9w-vqqp-v5xf
-
minimos
MINI-mvfx-pmq6-36qf
-
minimos
MINI-mvgp-xwrx-jp3g
-
minimos
MINI-mxf7-jh32-cq22
-
minimos
MINI-p25q-pf8p-37xg
-
minimos
MINI-p2rw-cpmj-w4fp
-
minimos
MINI-pfc8-92f6-x2rv
-
minimos
MINI-pmg7-9m59-83j3
-
minimos
MINI-pmvw-9fpx-g69q
-
minimos
MINI-pv2p-c7rq-254f
-
minimos
MINI-q26v-2xh4-mm3h
-
minimos
MINI-q3f4-h2hm-gq66
-
minimos
MINI-q8gf-67rc-p66c
-
minimos
MINI-qg3g-6mx2-j9m6
-
minimos
MINI-qp22-c236-vcv4
-
minimos
MINI-qpc2-xprm-39w8
-
minimos
MINI-qpr5-xfr9-x64x
-
minimos
MINI-qw6w-5w6c-qhch
-
minimos
MINI-r5hg-qv85-qvq9
-
minimos
MINI-r78p-684r-3xmx
-
minimos
MINI-r9mp-v348-v7gr
-
minimos
MINI-rgff-5ggf-jhc4
-
minimos
MINI-rrrp-px69-x9j9
-
minimos
MINI-rv94-wrxv-34mw
-
minimos
MINI-v479-9v36-mm43
-
minimos
MINI-v4w4-7rqf-hp35
-
minimos
MINI-v5j3-hr5p-rgrx
-
minimos
MINI-v67c-7q9r-g8q4
-
minimos
MINI-v97r-4j9r-7m2g
-
minimos
MINI-vqrr-4864-c2c3
-
minimos
MINI-vxhm-wqcr-c8qr
-
minimos
MINI-w7mp-g7jp-3qg8
-
minimos
MINI-w8q2-rhp6-586q
-
minimos
MINI-w9mh-vj3h-jp5f
-
minimos
MINI-wcg3-x7vf-mg95
-
minimos
MINI-wgcw-f2x6-xf89
-
minimos
MINI-wjfc-rm7q-6gf8
-
minimos
MINI-wm5w-27v3-v8wg
-
minimos
MINI-wrf8-mq4f-mf9f
-
minimos
MINI-wv35-8wvq-765c
-
minimos
MINI-x365-9387-22g2
-
minimos
MINI-x39w-2xvw-9735
-
minimos
MINI-x52r-38mg-6hv6
-
minimos
MINI-xg2c-m7r7-vpv4
-
minimos
MINI-xq45-xv8f-hwjq
-
minimos
MINI-xrrv-7gfh-cw7p
-
minimos
MINI-xw32-75wj-23xw
-
minimos
MINI-xw9q-jwc3-9gpx
-