The spdystream library versions prior to 0.5.1 contain a resource exhaustion vulnerability (CWE-770) due to lack of bounds checking on attacker-controlled 32-bit integer values used for memory allocation in SPDY/3 frame parsing. The affected allocations include SETTINGS frame entry counts, header counts, and individual header field sizes. Since SPDY header blocks are compressed, a small crafted payload can decompress into large memory allocations, allowing a remote peer sending SPDY frames to cause an out-of-memory crash. The vulnerability has been addressed and fixed in spdystream version 0.5.1.

An unauthenticated remote attacker able to send SPDY frames to a service using vulnerable spdystream versions can cause the process to exhaust memory and crash due to uncontrolled memory allocation. This results in a denial of service condition. There is no indication of code execution or data disclosure from the provided information.

Upgrade spdystream to version 0.5.1 or later, where this vulnerability is fixed. No other mitigations are indicated or required according to the vendor advisory. Patch status is confirmed fixed in version 0.5.1.