The spdystream library versions prior to 0.5.1 contain a resource exhaustion vulnerability (CWE-770) due to lack of validation on attacker-controlled counts and lengths in SPDY/3 frame parsing. Specifically, the SETTINGS frame entry count, header count in parseHeaderValueBlock, and individual header field sizes are read as 32-bit integers and used directly for memory allocation without bounds checking. Because SPDY header blocks are compressed with zlib, a small compressed payload can expand into large memory allocations. A remote peer sending crafted SPDY frames can exploit this to exhaust memory and crash the process. This vulnerability has been addressed in spdystream version 0.5.1.

An unauthenticated remote attacker able to send SPDY frames to a service using vulnerable spdystream versions can cause the service to exhaust its memory and crash, resulting in a denial of service. There is no indication of code execution or data disclosure. The impact is high due to the ease of triggering an out-of-memory condition remotely.

Upgrade spdystream to version 0.5.1 or later, where this vulnerability is fixed. Since the vendor advisory or patch links are not explicitly provided, confirm the update from the official spdystream or moby project sources. Patch status is not yet confirmed from vendor advisory content in this data; check vendor sources for current remediation guidance.