Executive brief
Protocol::HTTP2 is a Perl library used to handle HTTP/2 network traffic. A vulnerability in how it processes incoming data allows a remote attacker to send a specially crafted, small request that consumes a massive amount of server memory. This can lead to a "denial of service" where the server crashes or becomes unresponsive, disrupting business operations.
Technical details
Protocol::HTTP2 through version 1.12 is vulnerable to a resource exhaustion attack (HTTP/2 Bomb) due to improper handling of highly compressed HPACK data. The 'headers_decode' method fails to perform running size checks when materializing key-value pairs from indexed references. Additionally, the 'stream_header_block_add' method (since version 1.12) appends CONTINUATION frames to the per-stream buffer without any upper bound. Although the library advertises a MAX_HEADER_LIST_SIZE in its SETTINGS, this value is ignored during the decoding process, allowing an attacker to trigger massive memory allocation with minimal network traffic. A patch is available via CPANSec.
Affected products
- Perl CPAN Protocol::HTTP2 through 1.12
Timeline
- 2026-06-06: disclosed
- 2026-06-06: advisory