Към съдържанието
Търсене

CVE-2026-35469: moby spdystream, отказ на услуга

8.7

CVSS 4.0

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Засегнати продукти

  • moby spdystream: < 0.5.1
  • Red Hat Red Hat OpenShift Container Platform 4.19: 0:4.19.0-202606301915.p2.g63adf01.assembly.stream.el9 преди *
  • Red Hat RHEM 1.0 for RHEL 9: 0:1.0.3-1.el9em преди *
  • Red Hat RHEM 1.1 for RHEL 10: 0:1.1.3-1.el10em преди *
  • Red Hat RHEM 1.1 for RHEL 9: 0:1.1.3-1.el9em преди *
  • Red Hat Cluster Observability Operator 1.5.0: 1787593637 преди *
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6: 1788439505 преди *
  • Red Hat multicluster engine for Kubernetes 2.1: 1779135478 преди *
  • Red Hat multicluster engine for Kubernetes 2.11: 1778892370 преди *
  • Red Hat multicluster engine for Kubernetes 2.8: 1778288655 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13: 1778264389 преди *
  • Red Hat Red Hat Advanced Cluster Security 4.8: 1777307791 преди *
  • Red Hat Red Hat Advanced Cluster Security 4.9: 1777986630 преди *
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10: 1777976489 преди *
  • Red Hat Red Hat Container Native Virtualization 4.13: 1786346620 преди *
  • Red Hat Red Hat Container Native Virtualization 4.15: 1783042900 преди *
  • Red Hat Red Hat Container Native Virtualization 4.16: 1782184329 преди *
  • Red Hat Red Hat Container Native Virtualization 4.17: 1782358244 преди *
  • Red Hat Red Hat Container Native Virtualization 4.19: 1781590993 преди *
  • Red Hat Red Hat Container Native Virtualization 4.20: 1781838712 преди *
  • Red Hat Red Hat Container Native Virtualization 4.21: 1782012918 преди *
  • Red Hat Red Hat Container Native Virtualization 4.22: 1781852593 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.12: 1779716480 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.13: 1779889638 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.14: 1780956818 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.15: 1779915764 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.16: 1779251341 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.17: 1778707884 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.18: 1777070108 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.20: 1778138337 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.21: 1778164872 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.22: 1781103659 преди *
  • Red Hat Red Hat Openshift Data Foundation 4.18: 1786705347 преди *
  • Red Hat Red Hat Openshift Data Foundation 4.22: 1782932114 преди *
  • Red Hat cert-manager Operator for Red Hat OpenShift
  • Red Hat Dynamic Accelerator Slicer Operator for Red Hat OpenShift
  • Red Hat External Secrets Operator for Red Hat OpenShift
  • Red Hat Logical Volume Manager Storage
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift distributed tracing 3
  • Red Hat Red Hat OpenShift for Windows Containers
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Zero Trust Workload Identity Manager

Вид слабост

История

  • 16 април 2026 Публикувано

Други уязвимости в moby spdystream

Първоизточници

CVE-2026-35469: moby spdystream, отказ на услуга | freedomonline.bg