Skip to content
Fencer Vulns
medium 6.5

CVE-2026-35469 json

SpdyStream: DOS on CRI

published 2026-04-16 6 mo ago modified 2026-10-26 13 d ago also GHSA-pc3f-x583-g7j2 , GO-2026-4958 , EUVD-2026-23298

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.

Patch / fix

  • go github.com/moby/spdystream 0.5.1
  • Red Hat Red Hat OpenShift Container Platform 4.19 0:4.19.0-202606301915.p2.g63adf01.assembly.stream.el9, 0:4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9, 1779249730, 1779249801, 1779250076, 1779251684, 1779252023, 1781002119, 1781557059, 1782189936, 1782871003, 1782879945, 1783088446, 1783358181, 1785600792
  • Red Hat RHEM 1.0 for RHEL 9 0:1.0.3-1.el9em
  • Red Hat RHEM 1.1 for RHEL 10 0:1.1.3-1.el10em
  • Red Hat RHEM 1.1 for RHEL 9 0:1.1.3-1.el9em
  • Red Hat Cluster Observability Operator 1.5.0 1787593637
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 1788439505
  • Red Hat multicluster engine for Kubernetes 2.1 1779135478, 1786548918
  • Red Hat multicluster engine for Kubernetes 2.11 1778892370
  • Red Hat multicluster engine for Kubernetes 2.8 1778288646, 1778288655
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1778264389, 1778302921
  • Red Hat Red Hat Advanced Cluster Security 4.8 1777307791
  • Red Hat Red Hat Advanced Cluster Security 4.9 1777986630
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1777976489
  • Red Hat Red Hat Container Native Virtualization 4.13 1786346620
  • Red Hat Red Hat Container Native Virtualization 4.15 1783042900
  • Red Hat Red Hat Container Native Virtualization 4.16 1782184329
  • Red Hat Red Hat Container Native Virtualization 4.17 1782358244
  • Red Hat Red Hat Container Native Virtualization 4.19 1781590993
  • Red Hat Red Hat Container Native Virtualization 4.20 1781838712
  • Red Hat Red Hat Container Native Virtualization 4.21 1782012918
  • Red Hat Red Hat Container Native Virtualization 4.22 1781852593
  • Red Hat Red Hat OpenShift Container Platform 4.12 1779716474, 1779716476, 1779716480, 1782395416, 1784054795
  • Red Hat Red Hat OpenShift Container Platform 4.13 1779864381, 1779889606, 1779889638, 1784055726, 1784056255
  • Red Hat Red Hat OpenShift Container Platform 4.14 1780955979, 1780956441, 1780956818, 1781006909, 1784582377
  • Red Hat Red Hat OpenShift Container Platform 4.15 1779915526, 1779915561, 1779915764, 1779916110, 1784576933
  • Red Hat Red Hat OpenShift Container Platform 4.16 1779251341, 1780954223, 1780954827, 1780955112, 1782904234, 1782934190
  • Red Hat Red Hat OpenShift Container Platform 4.17 1778701022, 1778707884, 1782185537, 1782186020, 1782186155, 1782187374, 1782189013, 1784313542, 1784319218, 1787560246
  • Red Hat Red Hat OpenShift Container Platform 4.18 1777070108, 1778521451, 1779779708, 1779780022, 1779780608, 1782173522, 1782175121, 1782190146, 1783084308, 1783702867, 1785655390
  • Red Hat Red Hat OpenShift Container Platform 4.20 1778138337, 1778522102, 1781023952, 1781196883, 1781844985, 1782865684, 1783419985, 1785857530
  • microshift openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-olm openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-multus openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-selinux openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-greenboot openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-networking openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-gateway-api openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9
  • microshift-low-latency openshift 4.19 4.19.42-202608062155.p0.g46c9d67.assembly.4.19.42.el9

red hat advisories RHSA-2026:51422RHSA-2026:41019RHSA-2026:34755RHSA-2026:36796

  • containerd Linux Micro 6.0 1.7.29-159998.1.1
  • kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.17.1
  • containerd SLE Module for Containers 15 SP7, SLE Module for Basesystem 15 SP7, SLE Micro 5.5 +2 more 1.7.29-150000.142.1
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.30.1
  • containerd Linux Micro 6.1 1.7.29-slfo.1.1_4.1
  • containerd Linux Micro 6.0 1.7.29-4.1
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.27.1
  • kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.10.1

suse advisories SUSE-SU-2026:24136-1SUSE-SU-2026:3630-1SUSE-SU-2026:3504-1SUSE-SU-2026:3450-1SUSE-SU-2026:3203-1SUSE-SU-2026:22892-1

  • containerized-data-importer1.65 openSUSE Leap 16.0 1.65.0-160000.3.1
  • kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
  • containerized-data-importer1.66 openSUSE Tumbleweed 1.66.0-1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • containerized-data-importer1.65 openSUSE Tumbleweed 1.65.0-2.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.4-1.1
  • containerd openSUSE Leap 16.0 1.7.33-160000.1.1
  • containerd openSUSE Tumbleweed 1.7.33-1.1

opensuse advisories openSUSE-SU-2026:21824-1openSUSE-SU-2026:21590-1openSUSE-SU-2026:11514-1openSUSE-SU-2026:21483-1openSUSE-SU-2026:11305-1openSUSE-SU-2026:11307-1

  • containerd Alpine 3.24 2.2.3-r0

alpine advisories ALPINE-CVE-2026-35469

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • containerd2 Azure Linux 3.0 2.0.0-19
  • cert-manager Azure Linux 3.0 1.12.15-9
  • containerized-data-importer Azure Linux 3.0 1.62.0-6
  • cri-tools Azure Linux 3.0 1.32.0-6
  • docker-buildx Azure Linux 3.0 0.14.0-13
  • docker-compose Azure Linux 3.0 2.27.0-11
  • keda Azure Linux 3.0 2.14.1-13
  • kubernetes Azure Linux 3.0 1.30.10-23

azure linux advisories AZL-82937AZL-85625AZL-85628AZL-85634AZL-85637AZL-85640

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-35469 updated cvss 6.5

Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-operator-bundle, cert-manager/jetstack-cert-manager-acmesolver-rhel9
    affected: workaround, no fix available
  • Red Hat Dynamic Accelerator Slicer Operator for Red Hat OpenShift dynamic-accelerator-slicer-tech-preview/instaslice-webhook-rhel9, dynamic-accelerator-slicer-tech-preview/instaslice-rhel9-operator, dynamic-accelerator-slicer-tech-preview/instaslice-daemonset-rhel9, dynamic-accelerator-slicer-tech-preview/instaslice-operator-bundle, dynamic-accelerator-slicer-tech-preview/instaslice-scheduler-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/hypershift-rhel9-operator, multicluster-engine/cluster-curator-controller-rhel9, multicluster-engine/assisted-installer-controller-rhel9, multicluster-engine/cluster-api-provider-kubevirt-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multicluster-operators-subscription-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/ose-dpu-cni-rhel9, openshift4/ose-dpu-daemon-rhel9, openshift4/microshift-bootc-rhel9, openshift4/ose-dpu-rhel9-operator, openshift4/ose-csi-driver-nfs-rhel9, +18 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator, openshift4-wincw/windows-machine-config-operator-bundle
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argo-rollouts-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/virt-api-rhel9, container-native-virtualization/pr-helper-rhel9, container-native-virtualization/sidecar-shim-rhel9, container-native-virtualization/virt-handler-rhel9, container-native-virtualization/virt-launcher-rhel9, container-native-virtualization/virt-operator-rhel9, +6 more
    affected: workaround, no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/cluster-observability-rhel9-operator 1787593637
    fixed: vendor fix RHSA-2026:61314
show 31 more
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/cluster-logging-rhel9-operator 1791830134
    fixed: vendor fix RHSA-2026:83013
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.2 openshift-logging/cluster-logging-rhel9-operator 1789050399
    fixed: vendor fix RHSA-2026:68349
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/cluster-logging-rhel9-operator 1789659166
    fixed: vendor fix RHSA-2026:70870
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/cluster-logging-rhel9-operator 1788439505
    fixed: vendor fix RHSA-2026:66521
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1778288646, multicluster-engine 1778288655
    fixed: vendor fix RHSA-2026:17121
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine 1779135478, multicluster-engine/image-based-install-rhel9 1786548918
    fixed: vendor fix RHSA-2026:19099
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine 1778892370
    fixed: vendor fix RHSA-2026:19108
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1778264389, rhacm2 1778302921
    fixed: vendor fix RHSA-2026:17704
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1777307791
    fixed: vendor fix RHSA-2026:11070
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1777986630
    fixed: vendor fix RHSA-2026:13791
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security 1777976489
    fixed: vendor fix RHSA-2026:13829
  • Red Hat Container Native Virtualization 4.13 container-native-virtualization/virt-exportserver-rhel9 1786346620
    fixed: vendor fix RHSA-2026:53655
  • Red Hat Container Native Virtualization 4.15 container-native-virtualization/virt-exportserver-rhel9 1783042900
    fixed: vendor fix RHSA-2026:36162
  • Red Hat Container Native Virtualization 4.16 container-native-virtualization/virt-exportserver-rhel9 1782184329
    fixed: vendor fix RHSA-2026:33078
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/virt-exportserver-rhel9 1782358244
    fixed: vendor fix RHSA-2026:33071
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization/virt-exportserver-rhel9 1781590993
    fixed: vendor fix RHSA-2026:27914
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization/virt-exportserver-rhel9 1781838712
    fixed: vendor fix RHSA-2026:27983
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization/virt-exportserver-rhel9 1782012918
    fixed: vendor fix RHSA-2026:27903
  • Red Hat Container Native Virtualization 4.22 container-native-virtualization/virt-exportserver-rhel9 1781852593
    fixed: vendor fix RHSA-2026:27941
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-sriov-network-webhook 1779716476, openshift4/ose-node-feature-discovery 1782395416, openshift4/ose-sriov-network-operator 1779716474, openshift4/ose-openshift-apiserver-rhel8 1784054795, openshift4/ose-sriov-network-config-daemon 1779716480
    fixed: vendor fix RHSA-2026:34050
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-sriov-network-webhook 1779864381, openshift4/ose-node-feature-discovery 1784055726, openshift4/ose-sriov-network-operator 1779889606, openshift4/ose-openshift-apiserver-rhel8 1784056255, openshift4/ose-sriov-network-config-daemon 1779889638
    fixed: vendor fix RHSA-2026:40023
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-sriov-network-webhook 1780956441, openshift4/ose-node-feature-discovery 1780956818, openshift4/ose-sriov-network-operator 1781006909, openshift4/ose-openshift-apiserver-rhel8 1784582377, openshift4/ose-sriov-network-config-daemon 1780955979
    fixed: vendor fix RHSA-2026:25009
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-openshift-apiserver-rhel9 1784576933, openshift4/ose-sriov-network-webhook-rhel9 1779915526, openshift4/ose-node-feature-discovery-rhel9 1779915764, openshift4/ose-sriov-network-rhel9-operator 1779915561, openshift4/ose-sriov-network-config-daemon-rhel9 1779916110
    fixed: vendor fix RHSA-2026:23235
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-openshift-apiserver-rhel9 1782904234, openshift4/ose-sriov-network-webhook-rhel9 1780955112, openshift4/ose-node-feature-discovery-rhel9 1779251341, openshift4/ose-sriov-network-rhel9-operator 1780954223, openshift4/ose-sriov-network-config-daemon-rhel9 1780954827, openshift4/ose-cluster-node-tuning-rhel9-operator 1782934190
    fixed: vendor fix RHSA-2026:36621
  • Red Hat OpenShift Container Platform 4.17 openshift4 1778701022, openshift4 1778707884, openshift4/ose-ovn-kubernetes-rhel9 1787560246, openshift4/ose-smb-csi-driver-rhel9 1782186020, openshift4/ose-aws-ebs-csi-driver-rhel9 1784313542, openshift4/ose-openshift-apiserver-rhel9 1782189013, +5 more
    fixed: vendor fix RHSA-2026:47728
  • Red Hat OpenShift Container Platform 4.18 openshift4 1777070108, openshift4 1778521451, openshift4/ose-ovn-kubernetes-rhel9 1785655390, openshift4/ose-smb-csi-driver-rhel9 1782190146, openshift4/ose-aws-ebs-csi-driver-rhel9 1783702867, openshift4/ose-openshift-apiserver-rhel9 1782173522, +5 more
    fixed: vendor fix RHSA-2026:40828
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-hyperkube-rhel9 1782879945, openshift4/ose-ovn-kubernetes-rhel9 1785600792, openshift4/ose-smb-csi-driver-rhel9 1782189936, openshift4/ose-aws-ebs-csi-driver-rhel9 1783358181, openshift4/ose-openshift-apiserver-rhel9 1781557059, openshift4/ose-sriov-network-webhook-rhel9 1779249801, +28 more
    fixed: vendor fix RHSA-2026:51422
  • Red Hat OpenShift Container Platform 4.20 openshift4 1778138337, openshift4 1778522102, openshift4/ose-hypershift-rhel9 1791804907, openshift4/ose-hypershift-rhel9 1793158800, openshift4/ose-ovn-kubernetes-rhel9 1785857530, openshift4/ose-smb-csi-driver-rhel9 1781844985, +4 more
    fixed: vendor fix RHSA-2026:37629
  • Red Hat OpenShift Container Platform 4.21 openshift4 1778164872, openshift4 1779250427, openshift4/ose-hypershift-rhel9 1788278260, openshift4/ose-smb-csi-driver-rhel9 1782311084, openshift4/ose-openshift-apiserver-rhel9 1780979102, openshift4/ose-csi-external-provisioner-rhel9 1782861857, +3 more
    fixed: vendor fix RHSA-2026:37187
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-smb-csi-driver-rhel9 1781640970, openshift4/ose-azure-disk-csi-driver-rhel9 1782878115, openshift4/ose-csi-external-provisioner-rhel9 1782109368, openshift4/ose-csi-node-driver-registrar-rhel9 1782878255, openshift4/ose-ovn-kubernetes-microshift-rhel9 1784702398, openshift4/ose-aws-efs-csi-driver-container-rhel9 1781103659
    fixed: vendor fix RHSA-2026:25207
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431

4 more fixed, 45 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/moby/spdystream
<0.5.1
0.5.1

Affected products

  • moby spdystream
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat RHEM 1.0 for RHEL 9
  • Red Hat RHEM 1.1 for RHEL 10
  • Red Hat RHEM 1.1 for RHEL 9
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Security 4.8
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Container Native Virtualization 4.13
  • Red Hat Red Hat Container Native Virtualization 4.15
  • Red Hat Red Hat Container Native Virtualization 4.16
  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21
  • Red Hat Red Hat Container Native Virtualization 4.22
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.22
  • Red Hat cert-manager Operator for Red Hat OpenShift
  • Red Hat Dynamic Accelerator Slicer Operator for Red Hat OpenShift
  • Red Hat External Secrets Operator for Red Hat OpenShift
  • Red Hat Logical Volume Manager Storage
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift distributed tracing 3
  • Red Hat Red Hat OpenShift for Windows Containers
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Zero Trust Workload Identity Manager

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.