CVE-2026-35469

🗓️ 16 Apr 2026 21:19:23Reported by Alpine Linux Development TeamType

CVE-2026-35469: spdystream before 0.5.1 can exhaust memory via unbounded SPDY/3 frame counts during parsing.

Reporter	Title	Published	Views	Family All 1561
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 2 of 2)	7 Aug 202601:27	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2026-35469)	3 Sep 202618:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	18 Jul 202609:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	31 Jul 202622:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud multiple vulnerabilities addressed	17 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-memory condition in spdystream Go [CVE-2026-35469]	18 Jun 202618:29	–	ibm
ATTACKERKB	CVE-2026-35469	16 Apr 202621:19	–	attackerkb
CBLMariner	CVE-2026-35469 affecting package containerd2 for versions less than 2.0.0-19	16 Apr 202603:26	–	cbl_mariner
CBLMariner	CVE-2026-35469 affecting package cert-manager for versions less than 1.12.15-7	18 May 202620:36	–	cbl_mariner

OS	OS Version	Architecture	Package	Package Version	Filename
Alpine Linux	any	any	containerd	2.2.3-r0	containerd-2.2.3-r0.apk
Alpine Linux	3.24	any	containerd	2.2.3-r0	containerd-2.2.3-r0.apk

11 Sep 2026 13:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

CVSS 48.7

EPSS0.00656

SSVC