SpdyStream: DOS on CRI

🗓️ 16 Apr 2026 20:44:01Reported by GitHub Advisory DatabaseType

SpdyStream DOS via crafted SPDY frames; fix validates SETTINGS and header counts in v0.5.1.

Reporter	Title	Published	Views	Family All 349
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud multiple vulnerabilities addressed	17 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-memory condition in spdystream Go [CVE-2026-35469]	18 Jun 202618:29	–	ibm
ATTACKERKB	CVE-2026-35469	16 Apr 202621:19	–	attackerkb
AlpineLinux	CVE-2026-35469	16 Apr 202621:19	–	alpinelinux
CBLMariner	CVE-2026-35469 affecting package containerd2 for versions less than 2.0.0-19	16 Apr 202603:26	–	cbl_mariner
CBLMariner	CVE-2026-35469 affecting package cert-manager for versions less than 1.12.15-7	18 May 202620:36	–	cbl_mariner
CBLMariner	CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-4	18 May 202620:36	–	cbl_mariner
CBLMariner	CVE-2026-35469 affecting package cri-tools for versions less than 1.32.0-5	18 May 202620:36	–	cbl_mariner
CBLMariner	CVE-2026-35469 affecting package docker-buildx for versions less than 0.14.0-12	18 May 202620:36	–	cbl_mariner

Vulners

Node

moby spdystreamRange≤0.5.0go

Source	Link
github	www.github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-35469
github	www.github.com/moby/spdystream/releases/tag/v0.5.1
github	www.github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f
github	www.github.com/advisories/GHSA-pc3f-x583-g7j2

08 Jun 2026 23:36Current

5.9Medium risk

Vulners AI Score5.9

CVSS 48.7

EPSS0.0043

SSVC