8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35469

CVE-2026-35469: SpdyStream: DOS on CRI

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35469

CVE-2026-35469:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/moby/spdystream	go	<= 0.5.0	0.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the SPDY/3 frame parser of the moby/spdystream library, where it fails to validate attacker-controlled counts and lengths before allocating memory. This can be exploited by a remote attacker sending a small number of malformed SPDY control frames, causing the server to allocate gigabytes of memory, leading to an out-of-memory crash and a denial of service.

The analysis of the patches between the vulnerable version v0.5.0 and the fixed version v0.5.1 reveals three primary vulnerable functions:

(*spdy.SettingsFrame).read: This function handled SPDY SETTINGS frames. The vulnerability was in its failure to check the numSettings field against the actual frame payload length. The patch adds a bounds check (numSettings <= (length-4)/8) to ensure the number of settings is consistent with the frame size before allocating memory.
spdy.parseHeaderValueBlock: This function was responsible for parsing header blocks in SYN_STREAM, SYN_REPLY, and HEADERS frames. It was vulnerable to two distinct allocation attacks: one based on an excessive number of headers (numHeaders) and another on an excessive size for individual header names or values. The patch introduces configurable limits for both the header count and the individual field sizes and refactors the function to be a method of the Framer struct to access these limits.
(*spdy.Framer).parseControlFrame: This is a general-purpose function for parsing control frames. It was vulnerable because it didn't limit the length field of the control frame header. The patch adds a check to ensure the frame's length does not exceed a configured maximum payload size, preventing large allocation attempts.

An attacker would trigger these vulnerabilities by sending a specially crafted SPDY frame (e.g., SETTINGS, SYN_STREAM) that contains inflated length or count values. The vulnerable functions, upon parsing these frames, would then attempt to allocate an unreasonable amount of memory, causing the process to crash.

Vulnerable functions

(*spdy.SettingsFrame).read

spdy/read.go

The function reads a 32-bit `numSettings` value from the SPDY SETTINGS frame and allocates a slice of that size without validating it against the frame's declared length. An attacker can provide a large `numSettings` value in a small frame, causing a massive memory allocation that leads to a denial-of-service.

spdy.parseHeaderValueBlock

spdy/read.go

This function parses a SPDY header block and was vulnerable in two ways. First, it read a 32-bit `numHeaders` value and allocated a map of that size with no upper bound. Second, it read 32-bit length values for each header name and value and used them for allocations without validation. An attacker could provide inflated counts and lengths, causing excessive memory allocation and a denial-of-service. The function was refactored to be a method on the `Framer` struct as part of the fix.

(*spdy.Framer).parseControlFrame

spdy/read.go

This function reads the 24-bit length of an incoming SPDY control frame. Before the patch, it did not validate this length against any maximum limit. An attacker could specify a large length value, causing the server to attempt to read a large amount of data from the connection, potentially leading to resource exhaustion and denial-of-service. The patch introduces a check against a configurable maximum payload size.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.