47
55
60
55
42
CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table
CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.
28
55
55
60
55
35
30
55
42
35
30
30
42
60
42
55
55
55
55
35
30
55
30
55
47
60
30
47
35
35
HTTP/2 CONTINUATION Flood technique can be exploited in DoS attacks
60
60
35
30
55