https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 07:17:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35469 <p><strong>Affected:</strong> moby spdystream, Red Hat OpenShift Container Platform 4.19, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat Logging Subsystem for Red Hat OpenShift 6.6, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.8 and 37 more</p> <p>spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.</p> <p><strong>Affected:</strong> moby spdystream, Red Hat OpenShift Container Platform 4.19, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat Logging Subsystem for Red Hat OpenShift 6.6, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.8 and 37 more</p> <p>spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-35469 https://cve.radiocsirt.org/vuln/ghsa-mh2q-q3fh-2475 <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel</p> <p>multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit.</p> <p>## severity</p> <p>HIGH (availability / remote request amplification)</p> <p>## relevant links</p> <p>- repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58</p> <p>## vulnerability details</p> <p>**pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided)</p> <p>**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values(&#34;baggage&#34;)` → repeated `baggage.Parse` + member aggregation</p> <p>### root cause</p> <p>`extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).</p> <p>### impact</p> <p>in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel</p> <p>multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit.</p> <p>## severity</p> <p>HIGH (availability / remote request amplification)</p> <p>## relevant links</p> <p>- repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58</p> <p>## vulnerability details</p> <p>**pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided)</p> <p>**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values(&#34;baggage&#34;)` → repeated `baggage.Parse` + member aggregation</p> <p>### root cause</p> <p>`extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).</p> <p>### impact</p> <p>in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per…</p> https://cve.radiocsirt.org/vuln/ghsa-mh2q-q3fh-2475