data/osv/GO-2026-4958.json

{
  "schema_version": "1.3.1",
  "id": "GO-2026-4958",
  "modified": "0001-01-01T00:00:00Z",
  "published": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2026-35469",
    "GHSA-pc3f-x583-g7j2"
  ],
  "summary": "Uncontrolled resource consumption when parsing SPDY frames in github.com/moby/spdystream",
  "details": "The SPDY/3 frame parser in spdystream does not validate attacker-controlled counts and lengths before allocating memory. A remote peer that can send SPDY frames to a service using spdystream can cause the process to allocate gigabytes of memory with a small number of malformed control frames, leading to an out-of-memory crash.\n\nThree allocation paths in the receive side are affected:\n1. SETTINGS entry count: The SETTINGS frame reader reads a 32-bit numSettings from the payload and allocates a slice of that size without checking it against the declared frame length.\n2. Header count: parseHeaderValueBlock reads a 32-bit numHeaders from the decompressed header block and allocates an http.Header map of that size with no upper bound.\n3. Header field size: Individual header name and value lengths are read as 32-bit integers and used directly as allocation sizes with no validation.\n\nBecause SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into attacker-controlled bytes that the parser interprets as 32-bit counts and lengths. A single crafted frame is enough to exhaust process memory.",
  "affected": [
    {
      "package": {
        "name": "github.com/moby/spdystream",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/moby/spdystream",
            "symbols": [
              "Connection.Serve",
              "NewConnection",
              "idleAwareFramer.ReadFrame"
            ]
          },
          {
            "path": "github.com/moby/spdystream/spdy",
            "symbols": [
              "Framer.ReadFrame",
              "NewFramer"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2"
    },
    {
      "type": "FIX",
      "url": "https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moby/spdystream/releases/tag/v0.5.1"
    }
  ],
  "credits": [
    {
      "name": "Samuel Karp"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2026-4958",
    "review_status": "REVIEWED"
  }
}