CVE-2026-35469
Published: April 16th, 2026
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
MEDIUM
CVSS v3: 6.5
CVSS v3: 6.5
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 26.2 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 26.1 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 25.4 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 25.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 25.2 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 25.1 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 24.4 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 24.4.0 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 24.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 24.2 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 24.1 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 23.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 23.2 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 23.1 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 22.4 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 22.3 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 22.2 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 22.1 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 21.11 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 21.8 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 21.5.0 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 21.2.0 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.19.3667 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.18.3599 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.16.3445 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.15.3368 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.14.3263 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.13.3179 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.12.3054 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.11.3040 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.11.2990 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.10.2934 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.9.2878 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
| 11.4.8.2822 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-35469 is a vulnerability in moby/spdystream (a Go library for SPDY protocol multiplexing), not in the zlib C library. The flaw is unbounded memory allocation in spdystream’s Go SPDY/3 frame parser (parseHeaderValueBlock). The ‘zlib’ association exists only because SPDY headers are zlib-compressed, but the vulnerability is entirely in the Go application code that fails to validate decompressed sizes before allocation. Document Filters does not use Go, does not include spdystream, and does not implement any SPDY protocol handling. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
6.5
Base Severity
MEDIUM
Confidentiality Impact
NONE
Integrity Impact
NONE
Privileges Required
LOW
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version
3.1