جزئیات آسیب‌پذیری
CVE-2026-35469
Red Hat Dynamic Accelerator Slicer Operator for Red Hat OpenShiftRed Hat Multicluster Engine for KubernetesRed Hat Advanced Cluster Management for Kubernetes 2Red Hat OpenShift Container Platform 4Red Hat OpenShift GitOpsRed Hat OpenShift Virtualization 4
SpdyStream: DOS on CRI
CVSS 4.0
8.7بالا
شرح رسمی (انگلیسی)
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.7بالا | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 6.5متوسط | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Dynamic Accelerator Slicer Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Dynamic Accelerator Slicer Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Dynamic Accelerator Slicer Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Dynamic Accelerator Slicer Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Dynamic Accelerator Slicer Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift for Windows Containers | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift for Windows Containers | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | cert-manager Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | cert-manager Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | cert-manager Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | cert-manager Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| moby | spdystream | < 0.5.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۸۹- https://github.com/moby/spdystream/security/advisories/GHSA-pc3f-x583-g7j2 x_refsource_CONFIRM
- https://github.com/moby/spdystream/releases/tag/v0.5.1 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-35469 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2457729 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35469.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:41019 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51422 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34755 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61314 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66521 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17704 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11070 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11217 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13791 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13829 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53655 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36162 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33078 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33071 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27914 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27983 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27903 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27941 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34050 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40030 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21697 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40023 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40022 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21692 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25009 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43253 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23235 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43227 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36621 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20089 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25046 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:47728 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34099 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:47729 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17599 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60023 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17598 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34100 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40828 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29857 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37193 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17449 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51013 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12118 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29858 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21658 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37580 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37581 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25201 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34766 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20042 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27004 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51007 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20041 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29865 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37629 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25194 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34791 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17469 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27063 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51022 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17468 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29801 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37187 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25187 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34769 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63046 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17475 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44267 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20034 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29835 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25207 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34794 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29795 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44237 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27010 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56431 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37387 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19108 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19099 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59557 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17121 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17123 vendor-advisoryx_refsource_REDHAT
کانال تلگرام کُلون @kolunsec_fa
تازه‌های KEV، خبرهای مهم و خلاصه‌ی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۱/۲۸
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۰
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۶۵٪
احتمال بهره‌برداری در ۳۰ روز
۵۱٫۶٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-770Allocation of Resources Without Limits or Throttling