CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table.
When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself stays in the connection stream table and nothing in the distribution removes it. Stream identifiers increase monotonically, so a peer can open and close streams on one connection indefinitely, each close leaving a residual entry that is retained for the life of the connection.
SETTINGSMAXCONCURRENTSTREAMS does not bound this. That setting caps how many streams are live at once and is enforced, while the growth is made of streams the cap has already released, so it accumulates with concurrency never exceeding one. The client keeps the same table and grows the same way against a hostile server.
Measured against a server built on this module, roughly 920 bytes are retained per closed stream for about 19 bytes on the wire, so 100,000 sequential streams on one connection grow server resident memory by about 88 MiB. The streams are ordinary requests that the application accepts and completes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Protocol-HTTP2 (Perl)to a version that resolves this vulnerability.Fixed in 1.14 - Upgrade
Upgrade
Protocol-HTTP2 (Perl)to a version that resolves this vulnerability.Fixed in 1.14 or later
Event History
Frequently Asked Questions
Who can trigger the memory growth?
A peer on an existing HTTP/2 connection can trigger it by repeatedly opening and closing ordinary streams. This affects both a server using the module when receiving requests and a client using the module when connected to a hostile server.
Does SETTINGS_MAX_CONCURRENT_STREAMS limit this attack?
No. The concurrency slot is returned when each stream reaches CLOSED, so an attacker can create sequential streams with no more than one live stream at a time while retained entries continue to accumulate.
What is the practical impact of keeping a connection open?
Retained entries remain for the lifetime of the connection, allowing memory use to grow indefinitely as stream identifiers increase. The reported measurement is roughly 920 bytes retained per closed stream, or about 88 MiB after 100,000 sequential streams.
Which versions are affected?
Protocol::HTTP2 versions before 1.14 are affected. Version 1.14 includes the referenced change.