Go lib spdystream <0.5.1 OOM via SPDY frame parsing
CVE-2026-35469 Published on April 16, 2026
SpdyStream: DOS on CRI
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
Vulnerability Analysis
CVE-2026-35469 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Confidentiality Impact:
NONE
Availability Impact:
HIGH
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-35469
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
moby
spdystream:
-
Version < 0.5.1
is affected.
Red Hat OpenShift Container Platform 4.19:
-
Version 0:4.19.0-202606301915.p2.g63adf01.assembly.stream.el9 and below *
is unaffected.
Red Hat
RHEM 1.0 for RHEL 9:
-
Version 0:1.0.3-1.el9em and below *
is unaffected.
Red Hat
RHEM 1.1 for RHEL 10:
-
Version 0:1.1.3-1.el10em and below *
is unaffected.
Red Hat
RHEM 1.1 for RHEL 9:
-
Version 0:1.1.3-1.el9em and below *
is unaffected.
Red Hat
multicluster engine for Kubernetes 2.10:
-
Version 1779135478 and below *
is unaffected.
Red Hat
multicluster engine for Kubernetes 2.11:
-
Version 1778892370 and below *
is unaffected.
Red Hat
multicluster engine for Kubernetes 2.8:
-
Version 1778288655 and below *
is unaffected.
Red Hat
multicluster engine for Kubernetes 2.8:
-
Version 1778288646 and below *
is unaffected.
Red Hat Advanced Cluster Management for Kubernetes 2.13:
-
Version 1778264389 and below *
is unaffected.
Red Hat Advanced Cluster Management for Kubernetes 2.13:
-
Version 1778302921 and below *
is unaffected.
Red Hat Advanced Cluster Security for Kubernetes 4.10:
-
Version 1777976489 and below *
is unaffected.
Red Hat Advanced Cluster Security for Kubernetes 4.8:
-
Version 1777307791 and below *
is unaffected.
Red Hat Advanced Cluster Security for Kubernetes 4.9:
-
Version 1777986630 and below *
is unaffected.
Red Hat Container Native Virtualization 4.15:
-
Version 1783042900 and below *
is unaffected.
Red Hat Container Native Virtualization 4.16:
-
Version 1782184329 and below *
is unaffected.
Red Hat Container Native Virtualization 4.17:
-
Version 1782358244 and below *
is unaffected.
Red Hat Container Native Virtualization 4.19:
-
Version 1781590993 and below *
is unaffected.
Red Hat Container Native Virtualization 4.20:
-
Version 1781838712 and below *
is unaffected.
Red Hat Container Native Virtualization 4.21:
-
Version 1782012918 and below *
is unaffected.
Red Hat Container Native Virtualization 4.22:
-
Version 1781852593 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.12:
-
Version 1779716480 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.12:
-
Version 1779716474 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.12:
-
Version 1779716476 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.12:
-
Version 1782395416 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.13:
-
Version 1779889638 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.13:
-
Version 1779889606 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.13:
-
Version 1779864381 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.14:
-
Version 1780956818 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.14:
-
Version 1780955979 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.14:
-
Version 1781006909 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.14:
-
Version 1780956441 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.15:
-
Version 1779915764 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.15:
-
Version 1779916110 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.15:
-
Version 1779915561 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.15:
-
Version 1779915526 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.16:
-
Version 1779251341 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.16:
-
Version 1780954827 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.16:
-
Version 1780954223 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.16:
-
Version 1780955112 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.16:
-
Version 1782934190 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.16:
-
Version 1782904234 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1778707884 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1778701022 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1782187374 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1782189013 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1782186020 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1782186155 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1782185537 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.17:
-
Version 1782186155 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1777070108 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1778521451 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1779779708 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1779780608 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1779780022 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1782175121 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1782173522 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1782190146 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.18:
-
Version 1783084308 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1779251684 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1779252023 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1779250076 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1779249730 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1779249801 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1781002119 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1781557059 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1782189936 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1782871003 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1782879945 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1783358181 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.19:
-
Version 1783088446 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1778138337 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1778522102 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1781023952 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1781196883 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1781844985 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1782865684 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.20:
-
Version 1783419985 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1778164872 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1779250427 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1780973735 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1780979102 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1782311084 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1782861857 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.21:
-
Version 1783090488 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.22:
-
Version 1781103659 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.22:
-
Version 1781640970 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.22:
-
Version 1782109368 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.22:
-
Version 1782878115 and below *
is unaffected.
Red Hat OpenShift Container Platform 4.22:
-
Version 1782878255 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782932114 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782931768 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782932104 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783536000 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783535989 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783536515 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782932521 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783018461 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783018421 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782932812 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783537001 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782932919 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783537586 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782932969 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782933015 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782933042 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783537392 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782933235 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782933251 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783537955 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782933417 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783537742 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782933602 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1783019377 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782934054 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782934036 and below *
is unaffected.
Red Hat Openshift Data Foundation 4.22:
-
Version 1782934284 and below *
is unaffected.
cert-manager Operator for Red Hat OpenShift:
cert-manager Operator for Red Hat OpenShift:
cert-manager Operator for Red Hat OpenShift:
cert-manager Operator for Red Hat OpenShift:
Dynamic Accelerator Slicer Operator for Red Hat OpenShift:
Dynamic Accelerator Slicer Operator for Red Hat OpenShift:
Dynamic Accelerator Slicer Operator for Red Hat OpenShift:
Dynamic Accelerator Slicer Operator for Red Hat OpenShift:
Dynamic Accelerator Slicer Operator for Red Hat OpenShift:
External Secrets Operator for Red Hat OpenShift:
External Secrets Operator for Red Hat OpenShift:
External Secrets Operator for Red Hat OpenShift:
External Secrets Operator for Red Hat OpenShift:
Red Hat
Logical Volume Manager Storage:
Red Hat
Logical Volume Manager Storage:
Red Hat
Logical Volume Manager Storage:
Red Hat
Logical Volume Manager Storage:
Red Hat
Multicluster Engine for Kubernetes:
Red Hat
Multicluster Engine for Kubernetes:
Red Hat
Multicluster Engine for Kubernetes:
Red Hat Advanced Cluster Management for Kubernetes 2:
Red Hat Advanced Cluster Management for Kubernetes 2:
Red Hat Advanced Cluster Security 4:
Red Hat Advanced Cluster Security 4:
Red Hat Advanced Cluster Security 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift Container Platform 4:
Red Hat OpenShift distributed tracing 3:
Red Hat OpenShift for Windows Containers:
Red Hat OpenShift for Windows Containers:
Red Hat OpenShift GitOps:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat OpenShift Virtualization 4:
Red Hat
Zero Trust Workload Identity Manager:
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.
