spdystream is a Go library for multiplexing streams over SPDY connections

spdystream is the Go library moby/spdystream, used inside the Kubernetes / container ecosystem to multiplex streams for things like kubectl exec, kubectl port-forward, kubectl attach, and CRI streaming. Versions ≤ 0.5.0 read three attacker-controlled 32-bit fields directly out of a SPDY/3 control frame — the SETTINGS entry count, the header count in parseHeaderValueBlock, and per-header field lengths — and pass each one straight into a Go allocation without bounds checking. Because SPDY header blocks are zlib-compressed, a few hundred bytes on the wire decompresses into gigabytes of demanded memory, so a single crafted frame causes the receiving process to OOM-kill. Fixed in 0.5.1.

There is no vendor CVSS to compare against, but third parties (SentinelOne, OffSeq) have floated 8.7 HIGH. That is too hot. The bug is a deterministic DoS — no RCE, no info-disclosure, no memory corruption — and the realistic exposure is kubelet's streaming endpoint, which sits behind webhook/TLS-client auth in any reasonable cluster. The pattern matters (every node, every pod-exec path) but the impact ceiling is *process crash and restart*, not cluster takeover.

Why this verdict

• Impact ceiling is DoS. CWE-770 with no follow-on primitive — process crashes, systemd restarts kubelet, no code execution, no data exposure.
• Authn gate stands in front. Kubelet's --anonymous-auth=false (default on EKS, AKS, GKE, OpenShift, kubeadm ≥1.10) means an unauthenticated network attacker hits 401 before the SPDY parser is reached.
• Blast radius is one node. Even on success, cgroup limits and node auto-repair contain the outage to a single kubelet; no lateral, no cluster-wide collapse from one frame.
• Role multiplier: kubelet (typical role). Kubelet runs on every node and is canonically a high-value component, BUT the chain here ends in *node restart*, not domain/cluster takeover. No identity, secrets, or control-plane compromise flows from this bug. Floor stays at MEDIUM.
• Role multiplier: exposed CRI/Docker shim (rare). If a legacy docker/spdystream-backed daemon is exposed without auth (very uncommon in 2026), same DoS, same single-host blast radius.
• No KEV, EPSS 0.43%, no public weaponization. Threat tempo does not justify upgrading above MEDIUM.

Why not higher?

HIGH would require either a meaningful path to RCE / privilege escalation (there is none — Go's allocator faults cleanly), or that the typical deployment exposes spdystream to the open internet without auth (it does not — kubelet authn is on by default and the bug sits behind it). A node-restart DoS on hardened, authenticated endpoints does not clear the HIGH bar.

Why not lower?

LOW would mean either trivial mitigation in default configs or negligible impact; neither holds. Misconfigured clusters with --anonymous-auth=true or exposed read paths do exist, and a single frame causing repeatable kubelet OOM on every node in a cluster is operationally painful enough to clear MEDIUM. The bug is also reachable internally by any compromised pod that can dial the node IP.

1. Confirm --anonymous-auth=false on every kubelet — This is the single control that turns a remote DoS into a closed door. Audit with kubectl get --raw /api/v1/nodes/<node>/proxy/configz or check the kubelet config file directly. MEDIUM verdict carries no noisgate mitigation SLA, but do this audit as part of the next monthly hardening cycle.
2. Restrict network access to TCP/10250 — Cloud security groups / on-prem firewall rules should permit only the control-plane CIDR and approved monitoring agents to talk to kubelet. Block pod-to-node-IP egress to 10250 with a default-deny NetworkPolicy (Calico/Cilium GlobalNetworkPolicy). Same monthly hardening cadence — no formal mitigation SLA at MEDIUM.
3. Inventory transitive use of moby/spdystream — Run go mod why github.com/moby/spdystream across every Go binary you build, and SBOM-scan vendor images. Anything pinning ≤ 0.5.0 lands on the patch queue. Complete within 30 days so you have a clean rollout target.
4. Set per-process memory limits on kubelet — A systemd drop-in with MemoryMax= and Restart=always ensures one OOM does not cascade to host kernel panic and gives you fast self-healing while you wait on the binary update.
5. Schedule the actual fix — Roll kubelet / CRI / Cilium / any spdystream consumer to a build that vendors 0.5.1+ within the noisgate remediation SLA (365 days for MEDIUM, but most cluster operators will pick this up automatically in the next minor bump).

Run on each Linux node as root (or via your config-management tool) to check the spdystream version vendored into kubelet and the containerd/cri-o binary. Invocation: sudo ./check-cve-2026-35469.sh /usr/bin/kubelet. Requires read access to the binaries; no network calls.

#!/usr/bin/env bash
# check-cve-2026-35469.sh — detect vulnerable moby/spdystream (<= 0.5.0) inside a Go binary
# Usage: sudo ./check-cve-2026-35469.sh <path-to-go-binary> [more binaries...]
# Exits 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

FIXED="0.5.1"
status=0

ver_ge() {
  # returns 0 if $1 >= $2 (semver-ish)
  [ "$1" = "$2" ] && return 0
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

check_one() {
  local bin="$1"
  if [ ! -r "$bin" ]; then
    echo "UNKNOWN  $bin  (cannot read)"
    return 2
  fi

  if ! command -v go >/dev/null 2>&1; then
    # Fall back to strings — less reliable but no toolchain needed
    local hit
    hit=$(strings "$bin" 2>/dev/null | grep -Eo 'github.com/moby/spdystream[[:space:]]*v[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
    if [ -z "$hit" ]; then
      echo "UNKNOWN  $bin  (no spdystream string; may be statically dropped or absent)"
      return 2
    fi
    local v=${hit##*v}
    if ver_ge "$v" "$FIXED"; then
      echo "PATCHED   $bin  spdystream $v"
      return 0
    fi
    echo "VULNERABLE $bin  spdystream $v  (fix: $FIXED)"
    return 1
  fi

  local mod
  mod=$(go version -m "$bin" 2>/dev/null | awk '$2=="dep" && $3 ~ /spdystream$/ {print $4; exit}')
  if [ -z "$mod" ]; then
    echo "UNKNOWN  $bin  (spdystream not in module table)"
    return 2
  fi
  local v=${mod#v}
  if ver_ge "$v" "$FIXED"; then
    echo "PATCHED   $bin  spdystream v$v"
    return 0
  fi
  echo "VULNERABLE $bin  spdystream v$v  (fix: v$FIXED)"
  return 1
}

if [ $# -eq 0 ]; then
  set -- /usr/bin/kubelet /usr/local/bin/kubelet \
         /usr/bin/containerd /usr/local/bin/containerd \
         /usr/bin/crio /usr/local/bin/crio \
         /usr/bin/cilium-agent /opt/cni/bin/cilium-cni
fi

for b in "$@"; do
  [ -e "$b" ] || continue
  check_one "$b"
  rc=$?
  [ $rc -gt $status ] && status=$rc
done

exit $status

Sources

1. NVD — CVE-2026-35469
2. SentinelOne vuln DB entry
3. OffSeq Threat Radar — CWE-770 in moby/spdystream
4. cvefeed.io — SpdyStream DOS on CRI
5. Vulnerability-Lookup (CIRCL)
6. SUSE CVE tracker
7. Resolved Security advisory
8. Go vulnerability reports