Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3504-1

Опубликовано: 05 авг. 2026
Источник: suse-cvrf

Описание

Security update for containerd

This update for containerd fixes the following issues:

  • CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262266).

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
containerd-1.7.29-16.113.1
containerd-ctr-1.7.29-16.113.1
containerd-devel-1.7.29-16.113.1

Ссылки

Описание

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes - all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:containerd-1.7.29-16.113.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:containerd-ctr-1.7.29-16.113.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:containerd-devel-1.7.29-16.113.1
Ссылки
Уязвимость SUSE-SU-2026:3504-1