The vulnerability in spdystream (CVE-2026-35469) arises from the SPDY/3 frame parser failing to validate counts and lengths before memory allocation, specifically in SETTINGS frame entry counts, header counts, and individual header field sizes. These values are attacker-controlled and read as 32-bit integers without bounds checking, enabling a small compressed SPDY payload to decompress into large memory allocations. This can cause out-of-memory crashes in services using spdystream, including Kubernetes components Kubelet, CRI-O, and kube-apiserver. Exploitation requires elevated cluster roles permitting pod port forwarding, exec, attach, or node proxying. The issue is fixed in spdystream version 0.5.1. Red Hat advisories recommend restricting these Kubernetes cluster roles to trusted entities to mitigate risk.

Successful exploitation leads to denial of service by exhausting process memory, causing critical Kubernetes components (Kubelet, CRI-O, kube-apiserver) to become unresponsive. This impacts availability of container orchestration and management services. No confidentiality or integrity impact is reported. The attack requires network access and specific elevated cluster roles, limiting the attack surface to privileged users or compromised accounts.

A fix is available in spdystream version 0.5.1. Users should upgrade to this version or later. Additionally, restrict Kubernetes cluster roles that allow pod port forwarding (pods/portforward create), pod execution (pods/exec create), pod attachment (pods/attach create), and node proxying (nodes/proxy get/create) to trusted users and service accounts only. Modifying RBAC policies should be carefully tested to avoid disrupting legitimate operations. No other immediate actions are required once patched or mitigated by role restriction.