Skip to content
OpenAdvisories

Package · Debian

libprotocol-http2-perl

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-16028

    Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

    Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state returns the concurrency slot and clears most of the…

    perl-protocol-http2 libprotocol-http2-perl libprotocol-http2-perl Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-10725

    Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb

    Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method mate…

    CRUX Protocol::HTTP2 libprotocol-http2-perl perl-protocol-http2 Debian Ubuntu Alpine