CVE-2026-10725
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Jun 6, 2026
CISA due date
—
The record
Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode. It is absent from the decoder and from the :limits export tag.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | perl-Protocol-HTTP2 | 0 | 1.10-160000.3.1 |
| openSUSE:Tumbleweed | perl-Protocol-HTTP2 | 0 | 1.130.0-1.1 |
Related vulnerabilities
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409
- CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. CWE-409
- CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. CWE-409
- CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow… CWE-409