Description
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moby | spdystream | < 0.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-docker-spdystream | No fix yet | — |
| Debian 13 | golang-github-docker-spdystream | No fix yet | — |
| Debian 12 | golang-github-docker-spdystream | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-docker-spdystream | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-docker-spdystream | No fix yet | — |
| Ubuntu 25.10 | golang-github-docker-spdystream | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-docker-spdystream | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-docker-spdystream | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | golang-github-docker-spdystream | No fix yet | — |
| Ubuntu 18.04 LTS | golang-github-docker-spdystream | No fix yet | — |
| Ubuntu 16.04 LTS | golang-github-docker-spdystream | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | microshift +14 | 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9 | RHSA-2026:51422 |
| Red Hat OpenShift 4 | openshift +5 | 4.19.0-202606301915.p2.g63adf01.assembly.stream.el9 | RHSA-2026:34755 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | containerd | 1.7.29-150000.142.1 | SUSE-SU-2026:3450-1 |
| SLES 15 SP7 | kubernetes | 1.35.4-150600.13.34.1 | SUSE-SU-2026:2342-1 |
| SLES 15 SP7 | kubernetes-old | 1.33.11-150600.13.32.1 | SUSE-SU-2026:2460-1 |
| SLES 15 SP7 | kubevirt | 1.7.4-150700.3.27.1 | SUSE-SU-2026:3203-1, SUSE-SU-2026:2804-1 |
| SLES 15 SP7 | kubevirt-1.6 | 1.6.6-150700.15.10.1 | SUSE-SU-2026:3630-1, SUSE-SU-2026:2783-1 |
| SLES 15 SP5 | kubernetes1.23 | 1.23.17-150500.3.26.1 | SUSE-SU-2026:2340-1 |
| SLES 15 SP5 | kubernetes1.24 | 1.24.17-150500.3.33.1 | SUSE-SU-2026:2343-1 |
| SLES 15 SP5 | kubernetes1.25 | 1.25.16-150400.9.27.1 | SUSE-SU-2026:2345-1 |
| SLES 15 SP5 | kubernetes1.26 | 1.26.15-150400.9.27.1 | SUSE-SU-2026:2325-1 |
| SLES 15 SP5 | kubernetes1.27 | 1.27.16-150400.9.21.1 | SUSE-SU-2026:2339-1 |
| SLES 15 SP5 | kubernetes1.28 | 1.28.13-150400.9.19.1 | SUSE-SU-2026:2344-1 |
| SLES 15 SP4 | kubernetes1.23 | 1.23.17-150300.7.17.1 | SUSE-SU-2026:2315-1 |
| SLES 15 SP4 | kubernetes1.24 | 1.24.17-150400.9.27.1 | SUSE-SU-2026:2322-1 |
| SLES 15 SP4 | kubernetes1.25 | 1.25.16-150400.9.27.1 | SUSE-SU-2026:2345-1 |
| SLES 15 SP4 | kubernetes1.26 | 1.26.15-150400.9.27.1 | SUSE-SU-2026:2325-1 |
| SLES 15 SP4 | kubernetes1.27 | 1.27.16-150400.9.21.1 | SUSE-SU-2026:2339-1 |
| SLES 15 SP4 | kubernetes1.28 | 1.28.13-150400.9.19.1 | SUSE-SU-2026:2344-1 |
| SLES 12 SP5 | containerd | 1.7.29-16.113.1 | SUSE-SU-2026:3504-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kubernetes1.23 | 1.23.17-150500.3.26.1 | SUSE-SU-2026:2340-1 |
| SLES for SAP 15 SP5 | kubernetes1.24 | 1.24.17-150500.3.33.1 | SUSE-SU-2026:2343-1 |
| SLES for SAP 15 SP5 | kubernetes1.25 | 1.25.16-150400.9.27.1 | SUSE-SU-2026:2345-1 |
| SLES for SAP 15 SP5 | kubernetes1.26 | 1.26.15-150400.9.27.1 | SUSE-SU-2026:2325-1 |
| SLES for SAP 15 SP5 | kubernetes1.27 | 1.27.16-150400.9.21.1 | SUSE-SU-2026:2339-1 |
| SLES for SAP 15 SP5 | kubernetes1.28 | 1.28.13-150400.9.19.1 | SUSE-SU-2026:2344-1 |
| SLES for SAP 15 SP4 | kubernetes1.23 | 1.23.17-150300.7.17.1 | SUSE-SU-2026:2315-1 |
| SLES for SAP 15 SP4 | kubernetes1.24 | 1.24.17-150400.9.27.1 | SUSE-SU-2026:2322-1 |
| SLES for SAP 15 SP4 | kubernetes1.25 | 1.25.16-150400.9.27.1 | SUSE-SU-2026:2345-1 |
| SLES for SAP 15 SP4 | kubernetes1.26 | 1.26.15-150400.9.27.1 | SUSE-SU-2026:2325-1 |
| SLES for SAP 15 SP4 | kubernetes1.27 | 1.27.16-150400.9.21.1 | SUSE-SU-2026:2339-1 |
| SLES for SAP 15 SP4 | kubernetes1.28 | 1.28.13-150400.9.19.1 | SUSE-SU-2026:2344-1 |
| SLE Micro 6.1 | containerd | 1.7.29-slfo.1.1_4.1 | SUSE-SU-2026:22892-1 |
| SLE Micro 6.0 | containerd | 1.7.29-4.1 | SUSE-SU-2026:24136-1, SUSE-SU-2026:22800-1 |
| SLE Micro 5.5 | containerd | 1.7.29-150000.142.1 | SUSE-SU-2026:3450-1 |
| SLE Micro 5.4 | containerd | 1.7.29-150000.142.1 | SUSE-SU-2026:3450-1 |
| SLE Micro 5.3 | containerd | 1.7.29-150000.142.1 | SUSE-SU-2026:3450-1 |
| SLE HPC 15 SP5 | kubernetes1.23 | 1.23.17-150500.3.26.1 | SUSE-SU-2026:2340-1 |
| SLE HPC 15 SP5 | kubernetes1.24 | 1.24.17-150500.3.33.1 | SUSE-SU-2026:2343-1 |
| SLE HPC 15 SP5 | kubernetes1.25 | 1.25.16-150400.9.27.1 | SUSE-SU-2026:2345-1 |
| SLE HPC 15 SP5 | kubernetes1.26 | 1.26.15-150400.9.27.1 | SUSE-SU-2026:2325-1 |
| SLE HPC 15 SP5 | kubernetes1.27 | 1.27.16-150400.9.21.1 | SUSE-SU-2026:2339-1 |
| SLE HPC 15 SP5 | kubernetes1.28 | 1.28.13-150400.9.19.1 | SUSE-SU-2026:2344-1 |
| SLE HPC 15 SP4 | kubernetes1.23 | 1.23.17-150300.7.17.1 | SUSE-SU-2026:2315-1 |
| SLE HPC 15 SP4 | kubernetes1.24 | 1.24.17-150400.9.27.1 | SUSE-SU-2026:2322-1 |
| SLE HPC 15 SP4 | kubernetes1.25 | 1.25.16-150400.9.27.1 | SUSE-SU-2026:2345-1 |
| SLE HPC 15 SP4 | kubernetes1.26 | 1.26.15-150400.9.27.1 | SUSE-SU-2026:2325-1 |
| SLE HPC 15 SP4 | kubernetes1.27 | 1.27.16-150400.9.21.1 | SUSE-SU-2026:2339-1 |
| SLE HPC 15 SP4 | kubernetes1.28 | 1.28.13-150400.9.19.1 | SUSE-SU-2026:2344-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 1.7.33-1.1 | openSUSE-SU-2026:11107-1 |
| openSUSE Tumbleweed | containerized-data-importer1.65 | 1.65.0-2.1 | openSUSE-SU-2026:11305-1 |
| openSUSE Tumbleweed | containerized-data-importer1.66 | 1.66.0-1.1 | openSUSE-SU-2026:11514-1 |
| openSUSE Tumbleweed | kubevirt1.8 | 1.8.4-1.1 | openSUSE-SU-2026:11307-1 |
| openSUSE Leap 16.0 | containerd | 1.7.33-160000.1.1 | openSUSE-SU-2026:21213-1 |
| openSUSE Leap 16.0 | containerized-data-importer1.65 | 1.65.0-160000.3.1 | openSUSE-SU-2026:21824-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | kubevirt1.8 | 1.8.4-160000.1.1 | openSUSE-SU-2026:21590-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 2.2.3-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cert-manager | 1.12.15-9 | — |
| Azure Linux 3 | containerd2 | 2.0.0-19 | — |
| Azure Linux 3 | containerized-data-importer | 1.62.0-6 | — |
| Azure Linux 3 | cri-o | No fix yet | — |
| Azure Linux 3 | cri-tools | 1.32.0-6 | — |
| Azure Linux 3 | docker-buildx | 0.14.0-13 | — |
| Azure Linux 3 | docker-compose | 2.27.0-11 | — |
| Azure Linux 3 | keda | 2.14.1-13 | — |
| Azure Linux 3 | kubernetes | 1.30.10-23 | — |
| Azure Linux 3 | kubevirt | 1.7.1-7 | — |
| Azure Linux 3 | kured | 1.15.0-5 | — |
| Azure Linux 3 | moby-containerd-cc | 1.7.7-13 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-cd-3.2 | 3.2.8-r5 | — |
| Wolfi rolling | argo-cd-3.2-compat | 3.2.10-r0 | — |
| Wolfi rolling | argo-cd-3.3 +1 | 3.3.7-r1 | — |
| Wolfi rolling | argo-rollouts +1 | 1.9.0-r8 | — |
| Wolfi rolling | argo-workflows-3.7 +1 | 3.7.13-r2 | — |
| Wolfi rolling | argo-workflows-4.0 +2 | 4.0.4-r5 | — |
| Wolfi rolling | argocd-image-updater | 1.1.1-r9 | — |
| Wolfi rolling | aws-node-termination-handler | 1.25.6-r5 | — |
| Wolfi rolling | cert-manager-istio-csr | 0.16.0-r5 | — |
| Wolfi rolling | cilium-1.19 | 1.19.3-r1 | — |
| Wolfi rolling | cilium-cli | 0.19.2-r8 | — |
| Wolfi rolling | cloudnative-pg +1 | 1.29.0-r4 | — |
| Wolfi rolling | cluster-api-1.12-capd-manager +1 | 1.12.7-r1 | — |
| Wolfi rolling | consul-k8s-1.9-cli | 1.9.7-r0 | — |
| Wolfi rolling | crictl +1 | 1.36.0-r0 | — |
| Wolfi rolling | datadog-agent-7.72 +1 | 7.72.4-r28 | — |
| Wolfi rolling | datadog-agent-7.73 +1 | 7.73.3-r19 | — |
| Wolfi rolling | datadog-agent-7.77 +1 | 7.77.3-r4 | — |
| Wolfi rolling | docker-cli-buildx | 0.33.0-r3 | — |
| Wolfi rolling | dynamic-localpv-provisioner | 4.4.0-r8 | — |
| Wolfi rolling | eksctl | 0.225.0-r5 | — |
| Wolfi rolling | emissary +1 | 3.10.0-r28 | — |
| Wolfi rolling | envoy-gateway +1 | 1.7.2-r3 | — |
| Wolfi rolling | falcoctl | 0.12.2-r11 | — |
| Wolfi rolling | gitlab-agent-18.9 | 18.9.6-r3 | — |
| Wolfi rolling | gitlab-runner-18.10 | 18.10.1-r2 | — |
| Wolfi rolling | gitlab-runner-18.11 | 18.11.2-r2 | — |
| Wolfi rolling | gitlab-runner-18.9 | 18.9.0-r7 | — |
| Wolfi rolling | headlamp | 0.41.0-r7 | — |
| Wolfi rolling | helm-3 | 3.22.0-r0 | — |
| Wolfi rolling | hubble | 1.18.6-r7 | — |
| Wolfi rolling | infinispan-operator | 2.5.6-r2 | — |
| Wolfi rolling | istioctl-1.29 +3 | 1.29.2-r2 | — |
| Wolfi rolling | jitsucom-bulker-syncctl | 2.11.913-r23 | — |
| Wolfi rolling | juicefs-csi-driver | 0.31.4-r3 | — |
| Wolfi rolling | k3s +1 | 1.35.3.1-r4 | — |
| Wolfi rolling | k3s-1.32 +1 | 1.32.13.1-r13 | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.6.1-r4 | — |
| Wolfi rolling | k3s-1.35 | 1.35.3.1-r3 | — |
| Wolfi rolling | k3s-static-1.35 | 1.35.3.1-r2 | — |
| Wolfi rolling | k8sgpt | 0.4.31-r4 | — |
| Wolfi rolling | k8sgpt-operator | 0.2.27-r2 | — |
| Wolfi rolling | k8ssandra-client | 0.8.10-r10 | — |
| Wolfi rolling | k9s | 0.50.18-r19 | — |
| Wolfi rolling | kargo | 1.9.6-r2 | — |
| Wolfi rolling | kiali | 2.24.0-r3 | — |
| Wolfi rolling | kots | 1.130.0-r6 | — |
| Wolfi rolling | kpt | 1.0.0_beta55-r20 | — |
| Wolfi rolling | kube-arangodb-1.4 | 1.4.2-r1 | — |
| Wolfi rolling | kubectl-1.34 +4 | 1.34.7-r0 | — |
| Wolfi rolling | kubectl-1.35 +3 | 1.35.4-r0 | — |
| Wolfi rolling | kubeflow-pipelines-cache_server +2 | 2.16.0-r15 | — |
| Wolfi rolling | kubernetes-dashboard-api | 1.14.0-r7 | — |
| Wolfi rolling | kubescape | 4.0.5-r0 | — |
| Wolfi rolling | kubevela-vela-cli +1 | 1.10.8-r2 | — |
| Wolfi rolling | kwok | 0.7.0-r19 | — |
| Wolfi rolling | linkerd2-cli +3 | 26.4.3-r1 | — |
| Wolfi rolling | percona-server-mongodb-operator | 1.22.0-r13 | — |
| Wolfi rolling | postgres-operator | 1.15.1-r9 | — |
| Wolfi rolling | rancher-2.13 | 2.13.4-r5 | — |
| Wolfi rolling | rancher-agent-2.13 | 2.13.4-r4 | — |
| Wolfi rolling | rancher-fleet-cli | 0.15.0-r6 | — |
| Wolfi rolling | redis-operator | 0.24.0-r2 | — |
| Wolfi rolling | rook +8 | No fix yet | — |
| Wolfi rolling | skaffold | 2.18.3-r3 | — |
| Wolfi rolling | sonobuoy | 0.57.3-r18 | — |
| Wolfi rolling | teleport-18.6 +1 | 18.6.8-r12 | — |
| Wolfi rolling | terraform-provider-kubernetes | 3.1.0-r1 | — |
| Wolfi rolling | trivy | 0.69.3-r12 | — |
| Wolfi rolling | trivy-operator | 0.30.1-r6 | — |
| Wolfi rolling | vcluster +2 | 0.33.1-r4 | — |
| Wolfi rolling | velero | 1.18.0-r9 | — |
| Wolfi rolling | verticadb-operator | 25.4.0.0-r12 | — |
| Wolfi rolling | zarf | 0.75.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/moby/spdystream | < 0.5.1 | 0.5.1 | GHSA-pc3f-x583-g7j2 |
Advisories 32
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1950 Red Hat OpenShift Container Platform (kubelet, cri-o, kube-apiserver): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 2, 2026
- SUSE-SU-2026:24136-1 Security update for containerd SUSE / openSUSE Security Updates · Oct 15, 2026
- RHSA-2026:51422 Red Hat Security Advisory: Red Hat build of MicroShift 4.19.42 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:34755 Red Hat Security Advisory: OpenShift Container Platform 4.19.37 packages and security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- openSUSE-SU-2026:21824-1 Security update for containerized-data-importer1.65 SUSE / openSUSE Security Updates · Sep 12, 2026
- openSUSE-SU-2026:21590-1 Security update for kubevirt1.8 SUSE / openSUSE Security Updates · Aug 21, 2026
- SUSE-SU-2026:3630-1 Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 SUSE / openSUSE Security Updates · Aug 18, 2026
- openSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026
- SUSE-SU-2026:3504-1 Security update for containerd SUSE / openSUSE Security Updates · Aug 6, 2026
- SUSE-SU-2026:3450-1 Security update for containerd SUSE / openSUSE Security Updates · Aug 4, 2026
- WID-SEC-2026-1407 IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 3, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:22892-1 Security update for containerd SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22800-1 Security update for containerd SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:3203-1 Security update for kubevirt SUSE / openSUSE Security Updates · Jul 24, 2026
- openSUSE-SU-2026:11305-1 containerized-data-importer1.65-api-1.65.0-2.1 on GA media SUSE / openSUSE Security Updates · Jul 19, 2026
- openSUSE-SU-2026:11307-1 kubevirt1.8-container-disk-1.8.4-1.1 on GA media SUSE / openSUSE Security Updates · Jul 19, 2026
- SUSE-SU-2026:2783-1 Security update for kubevirt-1.6 SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:2804-1 Security update for kubevirt SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:21213-1 Security update for containerd SUSE / openSUSE Security Updates · Jul 3, 2026
- openSUSE-SU-2026:11107-1 containerd-1.7.33-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:2460-1 Security update for kubernetes-old SUSE / openSUSE Security Updates · Jun 20, 2026
- SUSE-SU-2026:2345-1 Security update for kubernetes1.25 SUSE / openSUSE Security Updates · Jun 11, 2026
- SUSE-SU-2026:2339-1 Security update for kubernetes1.27 SUSE / openSUSE Security Updates · Jun 11, 2026
- SUSE-SU-2026:2340-1 Security update for kubernetes1.23 SUSE / openSUSE Security Updates · Jun 11, 2026
- SUSE-SU-2026:2342-1 Security update for kubernetes SUSE / openSUSE Security Updates · Jun 11, 2026
- SUSE-SU-2026:2343-1 Security update for kubernetes1.24 SUSE / openSUSE Security Updates · Jun 11, 2026
- SUSE-SU-2026:2344-1 Security update for kubernetes1.28 SUSE / openSUSE Security Updates · Jun 11, 2026
- SUSE-SU-2026:2315-1 Security update for kubernetes1.23 SUSE / openSUSE Security Updates · Jun 10, 2026
- SUSE-SU-2026:2322-1 Security update for kubernetes1.24 SUSE / openSUSE Security Updates · Jun 10, 2026
- SUSE-SU-2026:2325-1 Security update for kubernetes1.26 SUSE / openSUSE Security Updates · Jun 10, 2026