CVE-2026-35469: spdystream Library DoS Vulnerability

CVE-2026-35469 Overview

CVE-2026-35469 is a resource exhaustion vulnerability in spdystream, a Go library used for multiplexing streams over SPDY connections. The vulnerability exists in versions 0.5.0 and below where the SPDY/3 frame parser fails to validate attacker-controlled counts and lengths before allocating memory, allowing a remote attacker to trigger an out-of-memory crash with a single crafted control frame.

Critical Impact

A remote peer can exhaust process memory and crash services using spdystream by sending a single malicious SPDY frame, leading to denial of service.

Affected Products

• spdystream versions 0.5.0 and below
• Applications and services utilizing the spdystream Go library for SPDY connections
• Container orchestration and networking tools that depend on spdystream

Discovery Timeline

• 2026-04-16 - CVE-2026-35469 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-35469

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The spdystream library's SPDY/3 frame parser contains three distinct allocation paths that are vulnerable to exploitation. When parsing incoming SPDY frames, the library reads 32-bit integers representing counts and sizes but uses these values directly for memory allocation without performing any bounds checking or validation.

The vulnerability is particularly dangerous because SPDY header blocks use zlib compression. This compression mechanism allows attackers to craft small network payloads that decompress into extremely large values, amplifying the attack's impact while minimizing the bandwidth required to execute it.

Root Cause

The root cause lies in the absence of input validation for three critical allocation paths within the frame parser: the SETTINGS frame entry count, the header count in the parseHeaderValueBlock function, and individual header field sizes. Each of these values is read as a 32-bit integer from attacker-controlled data and passed directly to memory allocation functions without any upper bounds enforcement or sanity checks.

Attack Vector

This vulnerability is exploitable over the network by any remote peer capable of sending SPDY frames to a service using the spdystream library. The attack requires no authentication and no user interaction. An attacker can craft a malicious SPDY control frame containing compressed header blocks that decompress to extremely large allocation requests. When the vulnerable parser processes this frame, it attempts to allocate the requested memory, rapidly exhausting available system memory and causing the target process to crash with an out-of-memory error.

The zlib compression used in SPDY header blocks serves as an amplification mechanism, enabling attackers to send relatively small network packets that trigger disproportionately large memory allocations on the target system.

Detection Methods for CVE-2026-35469

Indicators of Compromise

• Unexpected process crashes with out-of-memory errors in services using spdystream
• Sudden spikes in memory consumption followed by service termination
• Unusual SPDY traffic patterns with abnormally structured control frames
• Application logs showing memory allocation failures during SPDY frame processing

Detection Strategies

• Monitor application memory usage for rapid, unexplained increases when processing SPDY connections
• Implement network-level inspection for malformed or suspicious SPDY frames targeting services using spdystream
• Deploy dependency scanning tools to identify applications using vulnerable versions (<= 0.5.0) of spdystream
• Set up alerting for service crashes that correlate with incoming SPDY connection activity

Monitoring Recommendations

• Configure memory threshold alerts for processes handling SPDY traffic
• Implement rate limiting on SPDY connections to mitigate rapid exploitation attempts
• Enable detailed logging for SPDY frame parsing to capture anomalous frame characteristics
• Use container resource limits to prevent memory exhaustion from affecting host systems

How to Mitigate CVE-2026-35469

Immediate Actions Required

• Upgrade spdystream to version 0.5.1 or later immediately
• Identify all applications and services in your environment that depend on spdystream
• Audit Go module dependencies using go list -m all | grep spdystream to locate vulnerable versions
• Prioritize patching internet-facing services that accept SPDY connections from untrusted peers

Patch Information

The vulnerability has been addressed in spdystream version 0.5.1. The fix implements proper bounds checking for attacker-controlled values before memory allocation. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-pc3f-x583-g7j2 and the GitHub Release v0.5.1.

Workarounds

• Restrict network access to services using spdystream to trusted peers only until patching is complete
• Implement process-level memory limits to contain the impact of potential exploitation
• Deploy network firewalls or proxies to filter SPDY traffic from untrusted sources
• Consider temporarily disabling SPDY support in favor of HTTP/2 if application architecture permits

# Update spdystream dependency to patched version
go get github.com/moby/spdystream@v0.5.1
go mod tidy