CVE-2026-35469
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The Go library spdystream up to version 0.5.0 has a memory exhaustion vulnerability in the SPDY/3 frame parser. The parser does not validate attacker-controlled counts and lengths before allocating memory, affecting three allocation paths. Because SPDY header blocks are zlib-compressed, a small payload can decompress into large values, causing an out-of-memory crash.
Risk Assessment
A remote attacker who can send SPDY frames to a service using spdystream can cause a process crash due to memory exhaustion, leading to denial of service (DoS).
Recommendation
Update the spdystream library to version 0.5.1 or later, which contains the fix.
Related vulnerabilities
- CVE-2026-105889Critical
Blind SQL Injection vulnerability in the Tickera event ticketing system plugin. Improper neutralization of special elements in SQL commands allows an attacker to perform blind SQL injection. Affects versions up to 3.6.0.6.
- CVE-2026-104398Critical
Deserialization of untrusted data vulnerability in the AFFI – Affiliate Marketing for WooCommerce plugin. Allows an attacker to perform object injection. Affects versions up to 1.0.10.
- CVE-2026-108551Critical
Code injection vulnerability in openapi-typescript-codegen up to version 0.31.0. An attacker controlling an OpenAPI document can inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. This can be exploited by embedding a single quote in path keys, parameter names, servers[0].url, or info.version.
- CVE-2026-93945Critical
Deserialization of Untrusted Data vulnerability in the Balance theme by Axiomthemes allows Object Injection. This issue affects Balance from n/a through 1.12.0.
- CVE-2026-93944Critical
Deserialization of Untrusted Data vulnerability in the Camelia theme by ThemeREX Group allows Object Injection. This issue affects Camelia from n/a through 1.2.15.
- CVE-2026-93943Critical
Deserialization of Untrusted Data vulnerability in the Convex theme by ThemeREX Group allows Object Injection. This issue affects Convex from n/a through 1.16.0.
- CVE-2026-93942Critical
Deserialization of Untrusted Data vulnerability in the Dwell theme by ThemeREX Group allows Object Injection. This issue affects Dwell from n/a through 1.16.0.
- CVE-2026-93941Critical
Deserialization of Untrusted Data vulnerability in the Edema theme by ThemeREX Group allows Object Injection. This issue affects Edema from n/a through 1.2.2.2.
- CVE-2026-93940Critical
Deserialization of Untrusted Data vulnerability in the Greeny theme by ThemeREX Group allows Object Injection. This issue affects Greeny from n/a through 2.10.0.
- CVE-2026-93938Critical
Deserialization of Untrusted Data vulnerability in the Hogwords theme by ThemeREX Group allows Object Injection. This issue affects Hogwords from n/a through 1.2.7.
Original NVD description (English source)
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS