AI analysis
Protocol::HTTP2 versions before 1.14 for Perl never removes CLOSED streams from the per-connection stream table: when a stream closes, stream_state releases its concurrency slot and clears the stream's contents but leaves the table entry in place, and nothing in the distribution deletes it (CWE-401). A remote peer triggers this by opening and closing ordinary, accepted streams in sequence on one HTTP/2 connection; roughly 920 bytes are retained per closed stream, so 100,000 sequential streams grow server resident memory by about 88 MiB, and SETTINGS_MAX_CONCURRENT_STREAMS does not bound the growth because it only caps simultaneously live streams. The residual entries accumulate for the life of the connection, so an unauthenticated attacker can drive the process into memory exhaustion and cause a denial of service (availability impact only, CVSS 7.5). Both sides are affected: servers grow the table against a hostile client, and clients built on the module grow it the same way against a hostile server. Any operator of a Perl service or client using Protocol::HTTP2 is exposed; there is no public PoC, the flaw is not in CISA KEV, and EPSS rates 30-day exploitation probability at 0.6%, so no exploitation is known.
What to do: Inventory Perl servers and clients that load Protocol::HTTP2 and upgrade the module to 1.14 or later. As interim mitigation, bound per-connection lifetime (for example, cap requests or streams per connection and enforce idle timeouts at a front-end proxy) and monitor resident memory of processes speaking HTTP/2 with this module; note that WAF filtering offers little protection because the attack uses fully accepted, ordinary requests.
Affected
| CPAN (Perl) Protocol::HTTP2 | all versions before 1.14 |
Estimated exposure
nichelikely hundreds to low thousands of deployments (niche CPAN module; no public install counts) — Protocol::HTTP2 is a rarely used CPAN distribution with few dependent modules, and Perl HTTP/2 endpoints are uncommon in production because HTTP/2 is typically terminated by front-end proxies, so only a small population of directly exposed…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state returns the concurrency slot and clears most of the stream's keys, but the entry itself stays in the connection stream table and nothing in the distribution removes it. Stream identifiers increase monotonically, so a peer can open and close streams on one connection indefinitely, each close leaving a residual entry that is retained for the life of the connection. SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting caps how many streams are live at once and is enforced, while the growth is made of streams the cap has already released, so it accumulates with concurrency never exceeding one. The client keeps the same table and grows the same way against a hostile server. Measured against a server built on this module, roughly 920 bytes are retained per closed stream for about 19 bytes on the wire, so 100,000 sequential streams on one connection grow server resident memory by about 88 MiB. The streams are ordinary requests that the application accepts and completes.