CVE-2026-35469

Name	CVE-2026-35469
Description	spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1134148

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-docker-spdystream (PTS)	bookworm, bullseye	0.2.0-1	vulnerable
	forky, sid, trixie	0.5.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-docker-spdystream	source	(unstable)	(unfixed)			1134148

Notes

[trixie] - golang-github-docker-spdystream <no-dsa> (Minor issue)
[bookworm] - golang-github-docker-spdystream <no-dsa> (Minor issue)
[bullseye] - golang-github-docker-spdystream <ignored> (out of security support for bullseye)
https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2