Junglewise Threat Intelligence

CVE-2026-35469: Moby spdystream denial of service via memory amplification

CVE-2026-35469 · Severity: high · CVSS 6.5 · Published 2026-04-16

Vendors: Moby Project, Go.

Executive brief

spdystream is a software library used to manage multiple data streams over a single network connection. A vulnerability in how it handles incoming data allows a remote attacker to force the application to consume massive amounts of system memory. This can lead to a complete service outage or application crash with just a single specially crafted message.

Technical details

The SPDY/3 frame parser in spdystream fails to validate attacker-controlled counts and lengths before allocating memory. Specifically, the SETTINGS frame entry count, header count in parseHeaderValueBlock, and individual header field sizes are read as 32-bit integers and used directly for allocation without bounds checking. Because SPDY headers are zlib-compressed, a small compressed payload can specify extremely large allocation sizes. A remote attacker can exploit this by sending a single crafted control frame to exhaust process memory and trigger an out-of-memory (OOM) crash. This has been patched in version 0.5.1 by implementing consistency checks against frame lengths and enforcing default maximum limits for headers and field sizes.

Affected products

  • Moby spdystream <= 0.5.0

Timeline

  • 2026-04-15: advisory: GitHub Security Advisory GHSA-pc3f-x583-g7j2 published
  • 2026-04-16: patched: Version 0.5.1 released
  • 2026-04-16: disclosed: CVE-2026-35469 published

References