CVE-2026-35469: CWE-770: Allocation of Resources Without Limits or Throttling in moby spdystream
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
AI Analysis
Technical Summary
This advisory addresses CVE-2026-35469, a denial of service vulnerability in Red Hat OpenShift Container Platform 4.18.42 affecting kubelet, CRI-O, and kube-apiserver components through the SPDY streaming code. The vulnerability allows an unauthenticated attacker to cause a denial of service condition. Red Hat has released updated RPM packages and container images that fix this issue. The update is rated as having an Important security impact by Red Hat Product Security. Users should upgrade to the fixed versions as soon as they are available in the appropriate release channels.
Potential Impact
The vulnerability allows an unauthenticated attacker to cause a denial of service in key OpenShift components (kubelet, CRI-O, kube-apiserver) via SPDY streaming code. This can disrupt cluster operations and availability. No known exploits in the wild have been reported. The severity is rated high based on the potential impact to service availability.
Mitigation Recommendations
Red Hat has released fixed RPM packages and container images in OpenShift Container Platform 4.18.42 to address this vulnerability. Users should upgrade their clusters to this version using the OpenShift CLI or web console following Red Hat's official upgrade documentation. No additional mitigations are specified or required beyond applying the official update.
CVE-2026-35469: CWE-770: Allocation of Resources Without Limits or Throttling in moby spdystream
Description
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
CVSS v4.0
Score 8.7high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory addresses CVE-2026-35469, a denial of service vulnerability in Red Hat OpenShift Container Platform 4.18.42 affecting kubelet, CRI-O, and kube-apiserver components through the SPDY streaming code. The vulnerability allows an unauthenticated attacker to cause a denial of service condition. Red Hat has released updated RPM packages and container images that fix this issue. The update is rated as having an Important security impact by Red Hat Product Security. Users should upgrade to the fixed versions as soon as they are available in the appropriate release channels.
Potential Impact
The vulnerability allows an unauthenticated attacker to cause a denial of service in key OpenShift components (kubelet, CRI-O, kube-apiserver) via SPDY streaming code. This can disrupt cluster operations and availability. No known exploits in the wild have been reported. The severity is rated high based on the potential impact to service availability.
Mitigation Recommendations
Red Hat has released fixed RPM packages and container images in OpenShift Container Platform 4.18.42 to address this vulnerability. Users should upgrade their clusters to this version using the OpenShift CLI or web console following Red Hat's official upgrade documentation. No additional mitigations are specified or required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:17704
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a160979e29bf47b5064587d
Added to database: 05/26/2026, 20:58:33 UTC
Last enriched: 07/26/2026, 01:26:06 UTC
Last updated: 07/31/2026, 21:28:51 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.