PT-2026-33367 · Unknown · Spdystream
Published
2026-04-16
·
Updated
2026-05-26
·
CVE-2026-35469
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
spdystream versions prior to 0.5.1
Description
The SPDY/3 frame parser fails to validate attacker-controlled counts and lengths before allocating memory. This occurs in three allocation paths: the SETTINGS frame entry count, the header count in the
parseHeaderValueBlock() function, and individual header field sizes. These values are read as 32-bit integers and used directly for allocation without bounds checking. Since SPDY header blocks use zlib compression (a method of reducing data size), a small payload can decompress into large values. A remote peer can send a single crafted control frame to exhaust process memory, leading to an out-of-memory crash and denial of service.Recommendations
Update to version 0.5.1.
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spdystream