CVE-2026-35469: Moby Spdystream

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Affected products

  • Moby Spdystream: before 0.5.1 (fixed in 0.5.1)
  • Red Hat Cert-Manager Operator For Red Hat Openshift
  • Red Hat Cluster Observability Operator 1.5.0: before 1787593637 (fixed in 1787593637)
  • Red Hat Dynamic Accelerator Slicer Operator For Red Hat Openshift
  • Red Hat External Secrets Operator For Red Hat Openshift
  • Red Hat Logging Subsystem For Red Hat Openshift 6.6: before 1788439505 (fixed in 1788439505)
  • Red Hat Logical Volume Manager Storage
  • Red Hat Multicluster Engine For Kubernetes
  • Red Hat Multicluster Engine For Kubernetes 2.1: before 1779135478 (fixed in 1779135478); before 1786548918 (fixed in 1786548918)
  • Red Hat Multicluster Engine For Kubernetes 2.11: before 1778892370 (fixed in 1778892370)
  • Red Hat Multicluster Engine For Kubernetes 2.8: before 1778288655 (fixed in 1778288655); before 1778288646 (fixed in 1778288646)
  • Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.13: before 1778264389 (fixed in 1778264389); before 1778302921 (fixed in 1778302921)
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Advanced Cluster Security 4.8: before 1777307791 (fixed in 1777307791)
  • Red Hat Red Hat Advanced Cluster Security 4.9: before 1777986630 (fixed in 1777986630)
  • Red Hat Red Hat Advanced Cluster Security For Kubernetes 4.10: before 1777976489 (fixed in 1777976489)
  • Red Hat Red Hat Container Native Virtualization 4.13: before 1786346620 (fixed in 1786346620)
  • Red Hat Red Hat Container Native Virtualization 4.15: before 1783042900 (fixed in 1783042900)
  • Red Hat Red Hat Container Native Virtualization 4.16: before 1782184329 (fixed in 1782184329)
  • Red Hat Red Hat Container Native Virtualization 4.17: before 1782358244 (fixed in 1782358244)
  • Red Hat Red Hat Container Native Virtualization 4.19: before 1781590993 (fixed in 1781590993)
  • Red Hat Red Hat Container Native Virtualization 4.20: before 1781838712 (fixed in 1781838712)
  • Red Hat Red Hat Container Native Virtualization 4.21: before 1782012918 (fixed in 1782012918)
  • Red Hat Red Hat Container Native Virtualization 4.22: before 1781852593 (fixed in 1781852593)
  • and 22 more

Published 2026-04-16. Last modified 2026-09-11.