moby/spdystream ≤ 0.5.0 unbounded allocation in SPDY/3 frame parser (DoS)

#!/usr/bin/env bash
# check-cve-2026-35469.sh — detect vulnerable moby/spdystream (<= 0.5.0) inside a Go binary
# Usage: sudo ./check-cve-2026-35469.sh <path-to-go-binary> [more binaries...]
# Exits 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

FIXED="0.5.1"
status=0

ver_ge() {
  # returns 0 if $1 >= $2 (semver-ish)
  [ "$1" = "$2" ] && return 0
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

check_one() {
  local bin="$1"
  if [ ! -r "$bin" ]; then
    echo "UNKNOWN  $bin  (cannot read)"
    return 2
  fi

  if ! command -v go >/dev/null 2>&1; then
    # Fall back to strings — less reliable but no toolchain needed
    local hit
    hit=$(strings "$bin" 2>/dev/null | grep -Eo 'github.com/moby/spdystream[[:space:]]*v[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
    if [ -z "$hit" ]; then
      echo "UNKNOWN  $bin  (no spdystream string; may be statically dropped or absent)"
      return 2
    fi
    local v=${hit##*v}
    if ver_ge "$v" "$FIXED"; then
      echo "PATCHED   $bin  spdystream $v"
      return 0
    fi
    echo "VULNERABLE $bin  spdystream $v  (fix: $FIXED)"
    return 1
  fi

  local mod
  mod=$(go version -m "$bin" 2>/dev/null | awk '$2=="dep" && $3 ~ /spdystream$/ {print $4; exit}')
  if [ -z "$mod" ]; then
    echo "UNKNOWN  $bin  (spdystream not in module table)"
    return 2
  fi
  local v=${mod#v}
  if ver_ge "$v" "$FIXED"; then
    echo "PATCHED   $bin  spdystream v$v"
    return 0
  fi
  echo "VULNERABLE $bin  spdystream v$v  (fix: v$FIXED)"
  return 1
}

if [ $# -eq 0 ]; then
  set -- /usr/bin/kubelet /usr/local/bin/kubelet \
         /usr/bin/containerd /usr/local/bin/containerd \
         /usr/bin/crio /usr/local/bin/crio \
         /usr/bin/cilium-agent /opt/cni/bin/cilium-cni
fi

for b in "$@"; do
  [ -e "$b" ] || continue
  check_one "$b"
  rc=$?
  [ $rc -gt $status ] && status=$rc
done

exit $status