CVE-2026-35469

Name of the Vulnerable Software and Affected Versions spdystream versions prior to 0.5.1

Description The SPDY/3 frame parser fails to validate attacker-controlled counts and lengths before allocating memory. This occurs in three allocation paths: the SETTINGS frame entry count, the header count in the parseHeaderValueBlock() function, and individual header field sizes. These values are read as 32-bit integers and used directly for allocation without bounds checking. Since SPDY header blocks use zlib compression (a method of reducing data size), a small payload can decompress into large values. A remote peer can send a single crafted control frame to exhaust process memory, leading to an out-of-memory crash and denial of service.

Recommendations Update to version 0.5.1.