spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2460-1 advisory.

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265747).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262268).

    Changes for kubernetes-old:

    - Update to version 1.33.11:

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c2a89ccca5 advisory.

    - Update to release 1.33.13
    - Resolves: rhbz#2467604
    - Upstream fix

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b56d6f4b79 advisory.

    - Update to release v1.35.6
    - Resolves: rhbz#2467606
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-88ab77d111 advisory.

    - Update to release v1.34.9
    - Resolves: rhbz#2467605
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eee09dc43b advisory.

    - Update to release v1.34.9
    - Resolves: rhbz#2467605
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-da02662d41 advisory.

    - Update to release 1.33.13
    - Resolves: rhbz#2467604
    - Upstream fix

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0544eff1d8 advisory.

    - Update to release v1.35.6
    - Resolves: rhbz#2467606
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2322-1 advisory.

    This update for kubernetes1.24 fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2343-1 advisory.

    This update for kubernetes1.24 fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2340-1 advisory.

    This update for kubernetes1.23 fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2345-1 advisory.

    Security fixes:

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

    Other fixes:

    - Adding `Requires: diffutils` dependency to Kubernetes*-client package (bsc#1251168)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2342-1 advisory.

    This update for kubernetes fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265748).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262270).

    Changes for kubernetes:

    - Update to version 1.35.4:

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2325-1 advisory.

    This update for kubernetes1.26 fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2344-1 advisory.

    Security fixes:

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

    Other fixes:

    - Adding `Requires: diffutils` dependency to Kubernetes*-client package (bsc#1251168)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2315-1 advisory.

    This update for kubernetes1.23 fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2339-1 advisory.

    This update for kubernetes1.27 fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265740).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262271).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-05251d4863 advisory.

    Automatic update for kubernetes1.33-1.33.13-1.fc45.

    ##### **Changelog**

    ```
    * Fri Jun 12 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 1.33.13-1
    - Update to release 1.33.13
    - Resolves: rhbz#2467604
    - Upstream fix

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-18d1f457ba advisory.

    Automatic update for kubernetes1.34-1.34.9-1.fc45.

    ##### **Changelog**

    ```
    * Fri Jun 12 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 1.34.9-1
    - Update to release v1.34.9
    - Resolves: rhbz#2467605
    - Upstream fixes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f8b0e6c297 advisory.

    Automatic update for kubernetes1.35-1.35.6-1.fc45.

    ##### **Changelog**

    ```
    * Fri Jun 12 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 1.35.6-1
    - Update to release v1.35.6
    - Resolves: rhbz#2467606
    - Upstream fixes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016795 advisory.

    spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below,     the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory.
    Three allocation paths are affected: the SETTINGS frame entry count, the header count in     parseHeaderValueBlock, and individual header field sizes  all read as 32-bit integers and used directly     as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-     the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY     frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a     single crafted control frame. This issue has been fixed in version 0.5.1.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below,     the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory.
    Three allocation paths are affected: the SETTINGS frame entry count, the header count in     parseHeaderValueBlock, and individual header field sizes  all read as 32-bit integers and used directly     as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-     the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY     frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a     single crafted control frame. This issue has been fixed in version 0.5.1. (CVE-2026-35469)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321916	SUSE SLES15 Security Update : kubernetes-old (SUSE-SU-2026:2460-1)	Nessus	SuSE Local Security Checks	high
321862	Fedora 43 : kubernetes1.33 (2026-c2a89ccca5)	Nessus	Fedora Local Security Checks	high
321857	Fedora 44 : kubernetes1.35 (2026-b56d6f4b79)	Nessus	Fedora Local Security Checks	high
321855	Fedora 43 : kubernetes1.34 (2026-88ab77d111)	Nessus	Fedora Local Security Checks	high
321849	Fedora 44 : kubernetes1.34 (2026-eee09dc43b)	Nessus	Fedora Local Security Checks	high
321847	Fedora 44 : kubernetes1.33 (2026-da02662d41)	Nessus	Fedora Local Security Checks	high
321845	Fedora 43 : kubernetes1.35 (2026-0544eff1d8)	Nessus	Fedora Local Security Checks	high
321067	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2026:2322-1)	Nessus	SuSE Local Security Checks	high
321063	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2026:2343-1)	Nessus	SuSE Local Security Checks	high
321052	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2026:2340-1)	Nessus	SuSE Local Security Checks	high
321051	SUSE SLES15 Security Update : kubernetes1.25 (SUSE-SU-2026:2345-1)	Nessus	SuSE Local Security Checks	high
321046	SUSE SLES15 Security Update : kubernetes (SUSE-SU-2026:2342-1)	Nessus	SuSE Local Security Checks	high
321036	SUSE SLES15 Security Update : kubernetes1.26 (SUSE-SU-2026:2325-1)	Nessus	SuSE Local Security Checks	high
321023	SUSE SLES15 Security Update : kubernetes1.28 (SUSE-SU-2026:2344-1)	Nessus	SuSE Local Security Checks	high
321000	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2026:2315-1)	Nessus	SuSE Local Security Checks	high
320999	SUSE SLES15 Security Update : kubernetes1.27 (SUSE-SU-2026:2339-1)	Nessus	SuSE Local Security Checks	high
320886	Fedora 45 : kubernetes1.33 (2026-05251d4863)	Nessus	Fedora Local Security Checks	high
320885	Fedora 45 : kubernetes1.34 (2026-18d1f457ba)	Nessus	Fedora Local Security Checks	high
320884	Fedora 45 : kubernetes1.35 (2026-f8b0e6c297)	Nessus	Fedora Local Security Checks	high
313501	Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-016795)	Nessus	Unity Linux Local Security Checks	high
306748	Linux Distros Unpatched Vulnerability : CVE-2026-35469	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35469

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high