CVE catalog

CVE-2026-35469

Severity: High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Apr 13, 2026, 11:59:59 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.66% · Oct 25, 2026

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-github-docker-spdystream	sid	`0.5.0-1`	vulnerable
Debian	golang-github-docker-spdystream	forky	`0.5.0-1`	vulnerable
Debian	golang-github-docker-spdystream	trixie	`0.5.0-1`	vulnerable
Debian	golang-github-docker-spdystream	bookworm	`0.2.0-1`	vulnerable
Cpe	golang-github-docker-spdystream	Not reported	Not reported	vulnerable
Suse	containerd	linux enterprise server ltss extended security 12 sp5	`1.7.29-16.113.1`	fixed
Opensuse	kubevirt1.8	tumbleweed	`1.8.4-1.1`	fixed
Suse	kubevirt	linux enterprise module for containers 15 sp7	`1.7.4-150700.3.27.1`	fixed
Suse	kubevirt-1.6	linux enterprise module for containers 15 sp7	`1.6.6-150700.15.10.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-github-docker-spdystream	source	sid	`(unfixed)`	not yet assigned	Not reported	[1134148]
Debian	golang-github-docker-spdystream	source	forky	`(unfixed)`	not yet assigned	Not reported	[1134148]
Debian	golang-github-docker-spdystream	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1134148]
Debian	golang-github-docker-spdystream	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1134148]
Suse	containerd	rpm	linux enterprise server ltss extended security 12 sp5	`1.7.29-16.113.1`	Not reported	SUSE-SU-2026:3504-1	Not reported
Opensuse	kubevirt1.8	rpm	tumbleweed	`1.8.4-1.1`	Not reported	OPENSUSE-SU-2026:11307-1	Not reported
Suse	kubevirt	rpm	linux enterprise module for containers 15 sp7	`1.7.4-150700.3.27.1`	Not reported	SUSE-SU-2026:2804-1	Not reported
Suse	kubevirt-1.6	rpm	linux enterprise module for containers 15 sp7	`1.6.6-150700.15.10.1`	Not reported	SUSE-SU-2026:2783-1	Not reported

[Debian bug #1134148]

Notes

[trixie] golang-github-docker-spdystream: Minor issue [bookworm] golang-github-docker-spdystream: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-github-docker-spdystream-dev]Affected
Source package: [golang-github-docker-spdystream]
Details (2)
- 0.2.0-1 · all · bookworm
  Affected
  nvd · golang-github-docker-spdystream · debian · bookworm; nvd · golang-github-docker-spdystream · debian · 12
- 0.2.0-1 · all · bookworm
  Affected
  nvd · golang-github-docker-spdystream · debian · bookworm; nvd · golang-github-docker-spdystream · debian · 12

[Debian 13 (Trixie)]

[golang-github-docker-spdystream-dev]Affected
Source package: [golang-github-docker-spdystream]
Details (2)
- 0.5.0-1 · all · trixie
  Affected
  nvd · golang-github-docker-spdystream · debian · 13
- 0.5.0-1 · all · trixie
  Affected
  nvd · golang-github-docker-spdystream · debian · 13

[openSUSE Tumbleweed]

[kubevirt1.8-container-disk]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-libguestfs-tools]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-manifests]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-pr-helper-conf]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-sidecar-shim]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-tests]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-api]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-controller]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virtctl]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-exportproxy]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-exportserver]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-handler]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-launcher]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-operator]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[kubevirt1.8-virt-synchronization-controller]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed
[obs-service-kubevirt1.8_containers_meta]Unknown
Source package: [kubevirt1.8]
Details (1)
- 1.8.4-5.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.8.4-1.1
  Version impact unknown
  nvd · kubevirt1.8 · opensuse · tumbleweed

Observed: Oct 27, 2026, 7:59:09 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]