spdystream is a Go library that multiplexes streams over SPDY connections. In versions 0.5.0 and earlier, the SPDY/3 frame parser reads 32‑bit counts and lengths supplied by the remote peer and uses them directly as allocation sizes, without performing bounds checking. Because SPDY header blocks are zlib‑compressed, an attacker can send a small on‑the‑wire frame that decompresses into a much larger value, causing the library to allocate excessive memory. A single crafted frame can exhaust process memory and trigger an out‑of‑memory crash. This is a resource‑exhaustion vulnerability identified as CWE‑770.

The affected component is the moby:spdystream library. Versions 0.5.0 and all earlier releases contain the flaw; it has been fixed in 0.5.1. Any application or service that links against an unpatched version of spdystream is potentially vulnerable.

The CVSS score of 8.7 indicates high severity, while no EPSS score is available, making the exact likelihood of exploitation uncertain but not negligible. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the denial of service by sending a single malicious SPDY frame to any service that uses spdystream, such as container runtimes or other components that multiplex streams over SPDY. The resulting out‑of‑memory crash can lead to service interruption and potential cascading effects on dependent workloads.