{"id":"GO-2026-4958","revision":"90e650746bee4eecb2dab1aeedbcd64b","records":[{"revision":"90e650746bee4eecb2dab1aeedbcd64b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4958","aliases":["CVE-2026-35469","GHSA-pc3f-x583-g7j2"],"title":"Uncontrolled resource consumption when parsing SPDY frames in github.com/moby/spdystream","description":"The SPDY/3 frame parser in spdystream does not validate attacker-controlled counts and lengths before allocating memory. A remote peer that can send SPDY frames to a service using spdystream can cause the process to allocate gigabytes of memory with a small number of malformed control frames, leading to an out-of-memory crash.\n\nThree allocation paths in the receive side are affected:\n1. SETTINGS entry count: The SETTINGS frame reader reads a 32-bit numSettings from the payload and allocates a slice of that size without checking it against the declared frame length.\n2. Header count: parseHeaderValueBlock reads a 32-bit numHeaders from the decompressed header block and allocates an http.Header map of that size with no upper bound.\n3. Header field size: Individual header name and value lengths are read as 32-bit integers and used directly as allocation sizes with no validation.\n\nBecause SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into attacker-controlled bytes that the parser interprets as 32-bit counts and lengths. A single crafted frame is enough to exhaust process memory.","state":0,"publishedAt":"2026-05-26T22:49:05+00:00","modifiedAt":"2026-05-27T14:44:15.7903394+00:00","affected":[{"ecosystem":"Go","name":"github.com/moby/spdystream","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2","https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f","https://github.com/moby/spdystream/releases/tag/v0.5.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4958","license":"OSV · upstream source license applies","key":"osv:GO-2026-4958","identifiers":["GO-2026-4958","CVE-2026-35469","GHSA-pc3f-x583-g7j2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}