Memory Vulnerability in Protocol::HTTP2 for Perl

CVE-2026-10725

What is CVE-2026-10725?

The Protocol::HTTP2 module for Perl is susceptible to a memory exploitation flaw known as an HTTP/2 Bomb. This occurs due to the lack of a header-list size limit in the inbound HPACK implementation. Under certain conditions, a small HTTP/2 request can explode in size, consuming a substantial amount of server memory. The headers_decode method generates a complete key-value pair for each indexed reference without size verification. Moreover, since version 1.12, the stream_header_block_add method appends every CONTINUATION frame to the per-stream buffer unbounded. Although the MAX_HEADER_LIST_SIZE setting is advertised, it is not utilized during the decoding process, creating a significant risk for system resources.

References