{"schema_version":"1.7.5","id":"GO-2026-4958","published":"2026-05-26T22:49:05Z","modified":"2026-05-27T14:44:15.790339428Z","aliases":["CVE-2026-35469","GHSA-pc3f-x583-g7j2"],"related":["CGA-v7gj-rrxh-8985"],"summary":"Uncontrolled resource consumption when parsing SPDY frames in github.com/moby/spdystream","details":"The SPDY/3 frame parser in spdystream does not validate attacker-controlled counts and lengths before allocating memory. A remote peer that can send SPDY frames to a service using spdystream can cause the process to allocate gigabytes of memory with a small number of malformed control frames, leading to an out-of-memory crash.\n\nThree allocation paths in the receive side are affected:\n1. SETTINGS entry count: The SETTINGS frame reader reads a 32-bit numSettings from the payload and allocates a slice of that size without checking it against the declared frame length.\n2. Header count: parseHeaderValueBlock reads a 32-bit numHeaders from the decompressed header block and allocates an http.Header map of that size with no upper bound.\n3. Header field size: Individual header name and value lengths are read as 32-bit integers and used directly as allocation sizes with no validation.\n\nBecause SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into attacker-controlled bytes that the parser interprets as 32-bit counts and lengths. A single crafted frame is enough to exhaust process memory.","affected":[{"package":{"name":"github.com/moby/spdystream","ecosystem":"Go","purl":"pkg:golang/github.com/moby/spdystream"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/moby/spdystream","symbols":["Connection.Serve","NewConnection","idleAwareFramer.ReadFrame"]},{"path":"github.com/moby/spdystream/spdy","symbols":["Framer.ReadFrame","NewFramer"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4958.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2"},{"type":"FIX","url":"https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f"},{"type":"WEB","url":"https://github.com/moby/spdystream/releases/tag/v0.5.1"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4958"},"credits":[{"name":"Samuel Karp"}]}