CVE-2026-10725: Protocol::HTTP2 HTTP/2 Bomb Memory Exhaustion Vulnerability

Technical summary

Protocol::HTTP2 versions prior to 1.13 lack proper validation of cumulative header list size during HPACK decoding. The headers_decode method creates full copies of key-value pairs for each indexed header reference without tracking aggregate size. Additionally, since version 1.12, the stream_header_block_add method appends CONTINUATION frames to per-stream buffers without bounds checking. While the library advertises MAX_HEADER_LIST_SIZE (65536 bytes by default) in HTTP/2 SETTINGS frames, this limit is never enforced during the decode phase, enabling an HTTP/2 bomb attack where compressed headers decompress to vastly larger structures in server memory.

Business impact

Organizations deploying Protocol::HTTP2 face denial-of-service risk. A remote unauthenticated attacker can trigger memory exhaustion on affected servers by sending HTTP/2 requests with inflated header blocks, causing service degradation or crashes without requiring authentication or user interaction. This directly impacts availability SLAs for any web service or API gateway relying on this library.

Affected systems

Protocol::HTTP2 for Perl before version 1.13 is vulnerable. Any application or service using this library to handle inbound HTTP/2 connections—including web servers, API gateways, microservices, and proxies—is at risk if they have not updated to 1.13 or later. Verify your Perl module versions and dependency manifests to identify exposure.

Exploitability

Exploitability is straightforward. The vulnerability requires only network access and no authentication; an attacker can craft and send a malicious HTTP/2 request over the network to trigger memory exhaustion. The attack is reliable and does not depend on user interaction. However, this is a denial-of-service attack, not a code execution or data breach vector. Complexity is low due to the simplicity of HTTP/2 protocol manipulation tools.

Remediation

Upgrade Protocol::HTTP2 to version 1.13 or later. This version introduces proper header-list size enforcement during HPACK decoding and correctly applies the MAX_HEADER_LIST_SIZE limit advertised in SETTINGS frames. Test the update in a non-production environment before full deployment to ensure compatibility with dependent applications.

Patch guidance

Update the Protocol::HTTP2 Perl module to version 1.13 or newer using your package manager (e.g., cpan, cpanm, or your distribution's module system). Verify the upgrade via `perl -MProtocol::HTTP2 -e 'print $Protocol::HTTP2::VERSION'` and confirm it returns 1.13 or higher. Restart all services that depend on this library after patching.

Detection guidance

Monitor server memory usage for unexplained spikes correlated with HTTP/2 traffic. Enable HTTP/2 frame logging if available to identify requests with unusually large or numerous CONTINUATION frames. Look for HPACK decoder errors or per-stream buffer warnings in application logs. Network-level detection of HTTP/2 frames with compressed header blocks significantly larger than typical requests may indicate attack attempts. Consider implementing rate limiting or connection limits on HTTP/2 streams as a temporary mitigation.

Why prioritize this

This vulnerability earns a HIGH severity rating due to its high attack surface (network-facing, no authentication required), ease of exploitation, and direct impact on service availability. While it does not enable code execution or data theft, the simplicity of triggering denial-of-service on unpatched systems makes it a credible immediate threat. Organizations should treat this as a priority patch, especially for public-facing or customer-critical services.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an unauthenticated, low-complexity network attack vector with no user interaction required, resulting in a high impact to availability. The confidentiality and integrity scores are zero because this is a denial-of-service vector only. The unchanged scope and broad attack surface justify the elevated score. No privilege escalation or data exfiltration is possible via this flaw.

Frequently asked questions