Memory Exhaustion Vulnerability in Protocol::HTTP2 for Perl
CVE-2026-16028
Currently unrated
What is CVE-2026-16028?
The Protocol::HTTP2 module for Perl is susceptible to memory exhaustion due to improper handling of closed streams. When a stream transitions to the CLOSED state, the module fails to completely remove the corresponding entries from the connection stream table, allowing an attacker to indefinitely open and close streams. This behavior results in significant memory retention per closed stream, leading to potential depletion of server resources. In scenarios with high-frequency connections, the accumulated memory usage can escalate, impacting server performance and reliability. It is crucial for users running versions before 1.14 to apply updates to mitigate this vulnerability.