Is CVE-2026-35469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35469 being exploited in the wild.

How severe is CVE-2026-35469?

High severity, with a CVSS score of 6.5, published 16 April 2026.

Which products and versions are affected?

github.com/moby/spdystream (Go) <= 0.5.0, SEMVER:introduced=0,fixed=0.5.1; Moby Project Spdystream <= 0.5.0.

Is there a fix for CVE-2026-35469?

Yes. github.com/moby/spdystream (Go): upgrade to 0.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35469 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35469?

Check whether you run github.com/moby/spdystream (Go) or Moby Project Spdystream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35469: Moby spdystream denial of service via memory amplification

Q: Is there a fix for CVE-2026-35469?

Yes. github.com/moby/spdystream (Go): upgrade to 0.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35469 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-35469?

Check whether you run github.com/moby/spdystream (Go) or Moby Project Spdystream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35469 · Severity: high · CVSS 6.5 · Published 2026-04-16

spdystream is a software library used to manage multiple data streams over a single network connection. A vulnerability in how it handles incoming data allows a remote attacker to force the application to consume massive amounts of system memory. This can lead to a complete service outage or application crash with just a single specially crafted message.

Vendors: Go, Moby Project.

Quick answers

Is CVE-2026-35469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35469 being exploited in the wild.
How severe is CVE-2026-35469?: High severity, with a CVSS score of 6.5, published 16 April 2026.
Which products and versions are affected?: github.com/moby/spdystream (Go) <= 0.5.0, SEMVER:introduced=0,fixed=0.5.1; Moby Project Spdystream <= 0.5.0.
Is there a fix for CVE-2026-35469?: Yes. github.com/moby/spdystream (Go): upgrade to 0.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35469 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35469?: Check whether you run github.com/moby/spdystream (Go) or Moby Project Spdystream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/moby/spdystream (Go): upgrade to 0.5.1 or later
```
go get github.com/moby/spdystream@v0.5.1
```

Technical details

The SPDY/3 frame parser in spdystream fails to validate attacker-controlled counts and lengths before allocating memory. Specifically, the SETTINGS frame entry count, header count in parseHeaderValueBlock, and individual header field sizes are read as 32-bit integers and used directly for allocation without bounds checking. Because SPDY headers are zlib-compressed, a small compressed payload can specify extremely large allocation sizes. A remote attacker can exploit this by sending a single crafted control frame to exhaust process memory and trigger an out-of-memory (OOM) crash. This has been patched in version 0.5.1 by implementing consistency checks against frame lengths and enforcing default maximum limits for headers and field sizes.

Affected products

Moby spdystream <= 0.5.0

Identifiers

CVE-2026-35469
GHSA-pc3f-x583-g7j2
GO-2026-4958

Timeline

2026-04-15: advisory: GitHub Security Advisory GHSA-pc3f-x583-g7j2 published
2026-04-16: patched: Version 0.5.1 released
2026-04-16: disclosed: CVE-2026-35469 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.