EUVD-2026-23298Published

SpdyStream: DOS on CRI

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-35469

Published

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Source published: 16 Apr 2026 21:19:23 UTC
Source modified: 11 Sep 2026 12:09:03 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

euvd · EUVD-2026-23298

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Apr 16, 2026, 9:19:23 PM

dateUpdated: Sep 11, 2026, 12:09:03 PM

111 related source bulletins · separate from aliases

RHSA-2026:20042: Red Hat Security Advisory: OpenShift Container Platform 4.19.32 security and extras update

CVE-2025-13465 · CVE-2025-15284 · CVE-2025-58183 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-35469

SUSE-SU-2026:24136-1: Security update for containerd

CVE-2026-33186 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-53488

openSUSE-SU-2026:21824-1: Security update for containerized-data-importer1.65

CVE-2025-22869 · CVE-2025-22870 · CVE-2025-22872 · CVE-2025-47911 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-58058 · CVE-2025-58181 · CVE-2025-58190 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-33186 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-41178 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-56855 · CVE-2026-78662 · CVE-2026-84303 · CVE-2026-84304

RHSA-2026:47729: Red Hat Security Advisory: OpenShift Container Platform 4.17.56 security and extras update

CVE-2026-35469

SUSE-SU-2026:2343-1: Security update for kubernetes1.24

CVE-2026-33814 · CVE-2026-35469

RHSA-2026:51422: Red Hat Security Advisory: Red Hat build of MicroShift 4.19.42 security update

CVE-2026-35469

RHSA-2026:27063: Red Hat Security Advisory: OpenShift Container Platform 4.20.26 bug fix and security update

CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40895 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-46579

RHSA-2026:43227: Red Hat Security Advisory: OpenShift Container Platform 4.15.67 bug fix and security update

CVE-2026-33186 · CVE-2026-35469 · CVE-2026-46579

openSUSE-SU-2026:11107-1: containerd-1.7.33-1.1 on GA media

CVE-2026-33186 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-46680 · CVE-2026-47262 · CVE-2026-53488

SUSE-SU-2026:22800-1: Security update for containerd

CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821

RHSA-2026:37580: Red Hat Security Advisory: OpenShift Container Platform 4.19.38 bug fix and security update

CVE-2026-33186 · CVE-2026-35469 · CVE-2026-46579

RHSA-2026:29835: Red Hat Security Advisory: OpenShift Container Platform 4.21.22 security and extras update

CVE-2026-35469

SUSE-SU-2026:2315-1: Security update for kubernetes1.23

CVE-2026-33814 · CVE-2026-35469

openSUSE-SU-2026:11514-1: containerized-data-importer1.66-api-1.66.0-1.1 on GA media

CVE-2025-47911 · CVE-2025-58058 · CVE-2025-58190 · CVE-2026-27136 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39832 · CVE-2026-42508 · CVE-2026-56852

RHSA-2026:37193: Red Hat Security Advisory: OpenShift Container Platform 4.18.48 security and extras update

CVE-2026-35469

RHSA-2026:17599: Red Hat Security Advisory: OpenShift Container Platform 4.17.54 security and extras update

CVE-2026-24049 · CVE-2026-33186 · CVE-2026-35469

RHSA-2026:27983: Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

CVE-2026-9804 · CVE-2026-35469

RHSA-2026:25046: Red Hat Security Advisory: OpenShift Container Platform 4.16.64 security and extras update

CVE-2026-35469

RHSA-2026:60023: Red Hat Security Advisory: OpenShift Container Platform 4.17.57 bug fix and security update

CVE-2026-4800 · CVE-2026-9277 · CVE-2026-25681 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39820 · CVE-2026-42499 · CVE-2026-42504 · CVE-2026-46597 · CVE-2026-49332 · CVE-2026-50236 · CVE-2026-50237

SUSE-SU-2026:2342-1: Security update for kubernetes

CVE-2026-33814 · CVE-2026-35469

RHSA-2026:34099: Red Hat Security Advisory: OpenShift Container Platform 4.17.55 bug fix and security update

CVE-2026-27140 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:40022: Red Hat Security Advisory: OpenShift Container Platform 4.13.69 bug fix and security update

CVE-2026-29063 · CVE-2026-33186 · CVE-2026-35469 · CVE-2026-46579

RHSA-2026:25187: Red Hat Security Advisory: OpenShift Container Platform 4.21.20 bug fix and security update

CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:17123: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.6

CVE-2026-32285 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:17449: Red Hat Security Advisory: OpenShift Container Platform 4.18.42 security and extras update

CVE-2026-35469

RHSA-2026:53655: Red Hat Security Advisory: OpenShift Virtualization v4.13 Images

CVE-2026-13201 · CVE-2026-13622 · CVE-2026-35469

RHSA-2026:66521: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.1

CVE-2026-15792 · CVE-2026-17106 · CVE-2026-18140 · CVE-2026-29181 · CVE-2026-33818 · CVE-2026-35469 · CVE-2026-39828 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-41178 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46604 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-75593

RHSA-2026:44267: Red Hat Security Advisory: OpenShift Container Platform 4.21.26 bug fix and security update

CVE-2026-9277 · CVE-2026-12143 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40895 · CVE-2026-42338 · CVE-2026-45736 · CVE-2026-59869 · CVE-2026-59873

RHSA-2026:44237: Red Hat Security Advisory: OpenShift Container Platform 4.22.7 bug fix and security update

CVE-2026-9277 · CVE-2026-27136 · CVE-2026-35469 · CVE-2026-42338 · CVE-2026-59869 · CVE-2026-59873

openSUSE-SU-2026:21213-1: Security update for containerd

CVE-2024-25621 · CVE-2025-64329 · CVE-2026-33186 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-46680 · CVE-2026-47262 · CVE-2026-53488

RHSA-2026:27941: Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

CVE-2026-35469

RHSA-2026:11070: Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update

CVE-2026-29063 · CVE-2026-32286 · CVE-2026-33186 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-35469

SUSE-SU-2026:2344-1: Security update for kubernetes1.28

CVE-2026-33814 · CVE-2026-35469

SUSE-SU-2026:22892-1: Security update for containerd

CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821

RHSA-2026:51022: Red Hat Security Advisory: OpenShift Container Platform 4.20.33 bug fix and security update

CVE-2026-35469 · CVE-2026-49332

RHSA-2026:20034: Red Hat Security Advisory: OpenShift Container Platform 4.21.17 bug fix and security update

CVE-2025-58183 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-41674

RHSA-2026:51013: Red Hat Security Advisory: OpenShift Container Platform 4.18.52 bug fix and security update

CVE-2026-35469 · CVE-2026-49332

RHSA-2026:37187: Red Hat Security Advisory: OpenShift Container Platform 4.21.24 security and extras update

CVE-2026-35469

RHSA-2026:59557: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.6 security update

CVE-2024-45336 · CVE-2025-22866 · CVE-2026-10059 · CVE-2026-12143 · CVE-2026-19130 · CVE-2026-27145 · CVE-2026-35469 · CVE-2026-66794 · CVE-2026-66795 · CVE-2026-66804 · CVE-2026-73266 · CVE-2026-73267 · CVE-2026-73268 · CVE-2026-73269

openSUSE-SU-2026:21590-1: Security update for kubevirt1.8

CVE-2026-13201 · CVE-2026-13622 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-33814 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598 · CVE-2026-46600 · CVE-2026-56852

RHSA-2026:34766: Red Hat Security Advisory: OpenShift Container Platform 4.19.37 bug fix and security update

CVE-2026-6322 · CVE-2026-35469 · CVE-2026-44486 · CVE-2026-44492 · CVE-2026-44496

RHSA-2026:17598: Red Hat Security Advisory: OpenShift Container Platform 4.17.54 bug fix and security update

CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61731 · CVE-2025-61732 · CVE-2025-65637 · CVE-2025-68121 · CVE-2026-4800 · CVE-2026-25679 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:20089: Red Hat Security Advisory: OpenShift Container Platform 4.16.63 security and extras update

CVE-2025-58183 · CVE-2026-24049 · CVE-2026-33186 · CVE-2026-35469

RHSA-2026:70870: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.3

CVE-2026-18140 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-29181 · CVE-2026-33818 · CVE-2026-35469 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-41178 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42502 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46600 · CVE-2026-46604 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862

RHSA-2026:29857: Red Hat Security Advisory: OpenShift Container Platform 4.18.46 bug fix and security update

CVE-2026-29063 · CVE-2026-35469

RHSA-2026:17468: Red Hat Security Advisory: OpenShift Container Platform 4.20.23 bug fix and security update

CVE-2025-61726 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40175 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043

RHSA-2026:68349: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.13

CVE-2026-15792 · CVE-2026-18140 · CVE-2026-29181 · CVE-2026-32283 · CVE-2026-33818 · CVE-2026-35469 · CVE-2026-41178 · CVE-2026-42502 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862

RHSA-2026:27004: Red Hat Security Advisory: OpenShift Container Platform 4.19.35 bug fix and security update

CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40895

RHSA-2026:34769: Red Hat Security Advisory: OpenShift Container Platform 4.21.23 bug fix and security update

CVE-2026-33186 · CVE-2026-35469

RHSA-2026:40030: Red Hat Security Advisory: OpenShift Container Platform 4.12.94 bug fix and security update

CVE-2026-33186 · CVE-2026-35469

RHSA-2026:34100: Red Hat Security Advisory: OpenShift Container Platform 4.17.55 security and extras update

CVE-2025-13465 · CVE-2025-15284 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-35469

RHSA-2026:11217: Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update

CVE-2026-25679 · CVE-2026-29063 · CVE-2026-32286 · CVE-2026-33186 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:34794: Red Hat Security Advisory: OpenShift Container Platform 4.22.4 bug fix and security update

CVE-2026-9595 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-42154 · CVE-2026-44494

RHSA-2026:36162: Red Hat Security Advisory: OpenShift Virtualization v4.15 Images

CVE-2026-35469

RHSA-2026:33078: Red Hat Security Advisory: OpenShift Virtualization v4.16 Images

CVE-2026-35469

RHSA-2026:17704: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.7 security update

CVE-2026-35469

RHSA-2026:34050: Red Hat Security Advisory: OpenShift Container Platform 4.12.93 security and extras update

CVE-2026-35469

SUSE-SU-2026:2340-1: Security update for kubernetes1.23

CVE-2026-33814 · CVE-2026-35469

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

openSUSE-SU-2026:11307-1: kubevirt1.8-container-disk-1.8.4-1.1 on GA media

CVE-2026-35469

RHSA-2026:40828: Red Hat Security Advisory: OpenShift Container Platform 4.18.49 bug fix and security update

CVE-2026-35469 · CVE-2026-46579

RHSA-2026:12118: Red Hat Security Advisory: OpenShift Container Platform 4.18.39 bug fix and security update

CVE-2025-61731 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-35469

RHSA-2026:17475: Red Hat Security Advisory: OpenShift Container Platform 4.21.16 security and extras update

CVE-2026-33186 · CVE-2026-35469

RHSA-2026:19108: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.11.2

CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:29801: Red Hat Security Advisory: OpenShift Container Platform 4.20.27 security and extras update

CVE-2026-35469

RHSA-2026:51007: Red Hat Security Advisory: OpenShift Container Platform 4.19.42 bug fix and security update

CVE-2026-35469 · CVE-2026-49332 · CVE-2026-49978

RHSA-2026:37387: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update

CVE-2024-25621 · CVE-2024-40635 · CVE-2024-45310 · CVE-2025-8766 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22870 · CVE-2025-47911 · CVE-2025-52881 · CVE-2025-54410 · CVE-2025-58058 · CVE-2025-64329 · CVE-2025-66506 · CVE-2026-22772 · CVE-2026-23831 · CVE-2026-24117 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-25934 · CVE-2026-27136 · CVE-2026-27141 · CVE-2026-27903 · CVE-2026-33540 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-33814 · CVE-2026-34986 · CVE-2026-35172 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-39883 · CVE-2026-41506 · CVE-2026-41567 · CVE-2026-41568 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-45571 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

RHSA-2026:56431: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update

CVE-2025-61726 · CVE-2025-61729 · CVE-2025-64718 · CVE-2025-68470 · CVE-2026-1525 · CVE-2026-1526 · CVE-2026-1527 · CVE-2026-2229 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-6733 · CVE-2026-6734 · CVE-2026-9358 · CVE-2026-9679 · CVE-2026-9697 · CVE-2026-11525 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-22036 · CVE-2026-25645 · CVE-2026-33186 · CVE-2026-33349 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33750 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-40181 · CVE-2026-41305 · CVE-2026-41650 · CVE-2026-41907 · CVE-2026-42342 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-53550 · CVE-2026-59869

SUSE-SU-2026:3504-1: Security update for containerd

CVE-2026-35469

RHSA-2026:25207: Red Hat Security Advisory: OpenShift Container Platform 4.22.1 security and extras update

CVE-2026-35469

RHSA-2026:40023: Red Hat Security Advisory: OpenShift Container Platform 4.13.69 security and extras update

CVE-2026-35469

RHSA-2026:17469: Red Hat Security Advisory: OpenShift Container Platform 4.20.23 security and extras update

CVE-2025-13465 · CVE-2025-15284 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-29063 · CVE-2026-35469

RHSA-2026:61314: Red Hat Security Advisory: Cluster Observability Operator 1.5.2

CVE-2026-13676 · CVE-2026-27145 · CVE-2026-29181 · CVE-2026-32281 · CVE-2026-32285 · CVE-2026-35469 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-41178 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46600 · CVE-2026-55677 · CVE-2026-56852 · CVE-2026-73643

RHSA-2026:20041: Red Hat Security Advisory: OpenShift Container Platform 4.19.32 bug fix and security update

CVE-2025-12816 · CVE-2025-61726 · CVE-2025-66031 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-25679 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40175

RHSA-2026:83013: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.17

CVE-2026-18140 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-29181 · CVE-2026-32283 · CVE-2026-32285 · CVE-2026-33186 · CVE-2026-33818 · CVE-2026-35469 · CVE-2026-41178 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-46600 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-84445

RHSA-2026:21697: Red Hat Security Advisory: OpenShift Container Platform 4.12.91 security and extras update

CVE-2026-33186 · CVE-2026-35469

SUSE-SU-2026:2322-1: Security update for kubernetes1.24

CVE-2026-33814 · CVE-2026-35469

RHSA-2026:83502: Red Hat Security Advisory: OpenShift Container Platform 4.20.43 bug fix and security update

CVE-2026-33814 · CVE-2026-35469 · CVE-2026-46597 · CVE-2026-75888 · CVE-2026-84292 · CVE-2026-93017

RHSA-2026:41019: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update

CVE-2025-61729 · CVE-2026-25679 · CVE-2026-27137 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-33186 · CVE-2026-33811 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42508 · CVE-2026-46595

RHSA-2026:47728: Red Hat Security Advisory: OpenShift Container Platform 4.17.56 bug fix and security update

CVE-2026-9697 · CVE-2026-12151 · CVE-2026-13676 · CVE-2026-16242 · CVE-2026-26996 · CVE-2026-33186 · CVE-2026-35469 · CVE-2026-40895 · CVE-2026-42154 · CVE-2026-46579

RHSA-2026:29858: Red Hat Security Advisory: OpenShift Container Platform 4.18.46 security and extras update

CVE-2026-35469

openSUSE-SU-2026:11305-1: containerized-data-importer1.65-api-1.65.0-2.1 on GA media

CVE-2025-22870 · CVE-2025-22872 · CVE-2025-58058 · CVE-2025-58190 · CVE-2026-27136 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39832 · CVE-2026-42508

RHSA-2026:25009: Red Hat Security Advisory: OpenShift Container Platform 4.14.67 security and extras update

CVE-2026-33186 · CVE-2026-35469

RHSA-2026:25201: Red Hat Security Advisory: OpenShift Container Platform 4.19.34 bug fix and security update

CVE-2026-33186 · CVE-2026-35469

RHSA-2026:27914: Red Hat Security Advisory: OpenShift Virtualization v4.19 Images

CVE-2026-9804 · CVE-2026-35469

RHSA-2026:13791: Red Hat Security Advisory: RHACS 4.9.6 security and bug fix update

CVE-2026-25679 · CVE-2026-29063 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-33186 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:25194: Red Hat Security Advisory: OpenShift Container Platform 4.20.25 bug fix and security update

CVE-2026-1784 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:13829: Red Hat Security Advisory: RHACS 4.10.2 security and bug fix update

CVE-2025-13465 · CVE-2026-25679 · CVE-2026-29063 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-33186 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:37629: Red Hat Security Advisory: OpenShift Container Platform 4.20.29 security and extras update

CVE-2026-35469

RHSA-2026:36621: Red Hat Security Advisory: OpenShift Container Platform 4.16.66 bug fix and security update

CVE-2026-4800 · CVE-2026-9697 · CVE-2026-12151 · CVE-2026-26996 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-35469

RHSA-2026:17121: Red Hat Security Advisory: Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.6

CVE-2026-32285 · CVE-2026-34986 · CVE-2026-35469

RHSA-2026:29865: Red Hat Security Advisory: OpenShift Container Platform 4.19.36 security and extras update

CVE-2026-35469

RHSA-2026:23235: Red Hat Security Advisory: OpenShift Container Platform 4.15.65 security and extras update

CVE-2026-33186 · CVE-2026-35469

WID-SEC-W-2026-1407: IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

CVE-2026-26013 · CVE-2026-27142 · CVE-2026-28277 · CVE-2026-28684 · CVE-2026-32288 · CVE-2026-33151 · CVE-2026-33349 · CVE-2026-33532 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-33916 · CVE-2026-34601 · CVE-2026-35469 · CVE-2026-39406 · CVE-2026-39407 · CVE-2026-39408 · CVE-2026-39409 · CVE-2026-39410 · CVE-2026-39983 · CVE-2026-40175 · CVE-2026-40347 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-4923 · CVE-2026-4926

RHSA-2026:43253: Red Hat Security Advisory: OpenShift Container Platform 4.14.70 bug fix and security update

CVE-2026-33186 · CVE-2026-35469 · CVE-2026-46579

RHSA-2026:21692: Red Hat Security Advisory: OpenShift Container Platform 4.13.67 security and extras update

CVE-2026-33186 · CVE-2026-35469

RHSA-2026:21658: Red Hat Security Advisory: OpenShift Container Platform 4.18.43 security and extras update

CVE-2025-13465 · CVE-2025-15284 · CVE-2025-58183 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-35469

RHSA-2026:34791: Red Hat Security Advisory: OpenShift Container Platform 4.20.28 bug fix and security update

CVE-2026-9277 · CVE-2026-35469

RHSA-2026:29795: Red Hat Security Advisory: OpenShift Container Platform 4.22.3 bug fix and security update

CVE-2026-4800 · CVE-2026-6322 · CVE-2026-9277 · CVE-2026-35469 · CVE-2026-44293

msrc_CVE-2026-35469: SpdyStream: DOS on CRI

CVE-2026-35469

RHSA-2026:36796: Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

CVE-2025-61729 · CVE-2026-25679 · CVE-2026-27137 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-33186 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42508 · CVE-2026-46595

RHSA-2026:63046: Red Hat Security Advisory: OpenShift Container Platform 4.21.32 bug fix and security update

CVE-2026-27136 · CVE-2026-33814 · CVE-2026-35469 · CVE-2026-44990 · CVE-2026-45623 · CVE-2026-54272 · CVE-2026-69153 · CVE-2026-73566

RHSA-2026:33071: Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

CVE-2026-35469

RHSA-2026:27903: Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

CVE-2026-9804 · CVE-2026-35469

RHSA-2026:27010: Red Hat Security Advisory: OpenShift Container Platform 4.22.2 security and extras update

CVE-2026-35469

RHSA-2026:34755: Red Hat Security Advisory: OpenShift Container Platform 4.19.37 packages and security update

CVE-2026-35469

SUSE-SU-2026:2339-1: Security update for kubernetes1.27

CVE-2026-33814 · CVE-2026-35469

SUSE-SU-2026:2325-1: Security update for kubernetes1.26

CVE-2026-33814 · CVE-2026-35469

RHSA-2026:37581: Red Hat Security Advisory: OpenShift Container Platform 4.19.38 security and extras update

CVE-2026-35469

SUSE-SU-2026:2345-1: Security update for kubernetes1.25

CVE-2026-33814 · CVE-2026-35469

RHSA-2026:19099: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.3

CVE-2026-32285 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-35469

Source published: Apr 16, 2026, 9:19:23 PM (timezone not stated)
Source modified: Sep 11, 2026, 12:09:03 PM (timezone not stated)
Observed here: 1 Nov 2026 06:10:46 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

nvd · CVE-2026-35469

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-770

Original publisher date fields

published: 2026-04-16T22:16:37.920

lastModified: 2026-10-26T22:10:00.163

Source published: 16 Apr 2026 22:16:37 UTC
Source modified: 26 Oct 2026 22:10:00 UTC
Observed here: 27 Oct 2026 09:03:12 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-pc3f-x583-g7j2

Published

The SPDY/3 frame parser in spdystream does not validate attacker-controlled counts and lengths before allocating memory. A remote peer that can send SPDY frames to a service using spdystream can cause the process to allocate gigabytes of memory with a small number of malformed control frames, leading to an out-of-memory crash. Three allocation paths in the receive side are affected: 1. **SETTINGS entry count** -- The SETTINGS frame reader reads a 32-bit `numSettings` from the payload and allocates a slice of that size without checking it against the declared frame length. An attacker can set `numSettings` to a value far exceeding the actual payload, triggering a large allocation before any setting data is read. 2. **Header count** -- `parseHeaderValueBlock` reads a 32-bit `numHeaders` from the decompressed header block and allocates an `http.Header` map of that size with no upper bound. 3. **Header field size** -- Individual header name and value lengths are read as 32-bit integers and used directly as allocation sizes with no validation. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into attacker-controlled bytes that the parser interprets as 32-bit counts and lengths. A single crafted frame is enough to exhaust process memory. ## Impact Any program that accepts SPDY connections using spdystream -- directly or through a dependent library -- is affected. A remote peer that can send SPDY frames to the service can crash the process with a single crafted SPDY control frame, causing denial of service. ## Affected versions `github.com/moby/spdystream` <= v0.5.0 ## Fix v0.5.1 addresses the receive-side allocation bugs and adds related hardening: **Core fixes:** - **SETTINGS entry-count validation** -- The SETTINGS frame reader now checks that `numSettings` is consistent with the declared frame length (`numSettings <= (length-4)/8`) before allocating. - **Header count limit** -- `parseHeaderValueBlock` enforces a maximum number of headers per frame (default: 1000). - **Header field size limit** -- Individual header name and value lengths are checked against a per-field size limit (default: 1 MiB) before allocation. - **Connection closure on protocol error** -- The connection read loop now closes the underlying `net.Conn` when it encounters an `InvalidControlFrame` error, preventing further exploitation on the same connection. **Additional hardening:** - **Write-side bounds checks** -- All frame write methods now verify that payloads fit within the 24-bit length field, preventing the library from producing invalid frames. **Configurable limits:** - Callers can adjust the defaults using `NewConnectionWithOptions` or the lower-level `spdy.NewFramerWithOptions` with functional options: `WithMaxControlFramePayloadSize`, `WithMaxHeaderFieldSize`, and `WithMaxHeaderCount`.

Source published: 16 Apr 2026 20:44:01 UTC
Source modified: 10 Sep 2026 03:51:02 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Publisher rating · HIGH

osv · GO-2026-4958

Published

Source published: 26 May 2026 22:49:05 UTC
Source modified: 27 May 2026 14:44:15 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.