CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.
- Closed streams accumulate in the connection stream table, enabling remote memory-exhaustion DoS
- Fixed in Protocol::HTTP2 1.14, available on CPAN
- Disclosed on the oss-security mailing list on September 7, 2026
- CVEs
- CVE-2026-16028
- Products
- Protocol::HTTP2
- Organizations
- CPAN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16028 | Memory exhaustion DoS in Protocol::HTTP2 Perl module before 1.14 | 7.5 | <1% |
From the original article
Posted by Robert Rothenberg on Sep 07 ======================================================================== https://metacpan. org/dist/Protocol-HTTP2 VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.