Memory Allocation Flaw in Moby's spdystream Go Library

CVE-2026-35469

What is CVE-2026-35469?

The spdystream Go library, used for multiplexing streams over SPDY connections, has a significant memory allocation vulnerability in versions 0.5.0 and earlier. The SPDY/3 frame parser fails to properly validate counts and lengths that can be controlled by an attacker, leading to potential memory exhaustion and process crashes. Specifically, this affects the SETTINGS frame entry count and header field sizes, which are read as 32-bit integers and directly used as allocation sizes without adequate bounds checking. An adversary sending crafted SPDY frames to a service utilizing this library can exploit this flaw to provoke an out-of-memory condition. This issue has been addressed in version 0.5.1.

References