[<prev] [day] [month] [year] [list]
Message-ID: <ffe6a687-c94f-4557-bde2-06637549ad84@cpansec.org>
Date: Sat, 6 Jun 2026 10:16:32 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-10725: Protocol::HTTP2 versions through 1.12 for Perl is
vulnerable to a HTTP/2 Bomb
=======================================================================
CVE-2026-10725 CPAN Security Group
========================================================================
CVE ID: CVE-2026-10725
Distribution: Protocol-HTTP2
Versions: through 1.12
MetaCPAN: https://metacpan.org/dist/Protocol-HTTP2
VCS Repo: https://github.com/vlet/p5-Protocol-HTTP2
Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a
HTTP/2 Bomb
Description
-----------
Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a
HTTP/2 Bomb.
Protocol::HTTP2's inbound HPACK path has no header-list size limit, so
a small HTTP/2 request can expand into large server memory (the "HTTP/2
bomb").
The headers_decode method materialises a full key+value copy per
indexed reference with no running size check, and the
stream_header_block_add method appends (since version 1.12) every
CONTINUATION frame to the per-stream buffer unbounded.
MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but
never consulted on decode. It is absent from the decoder and from the
:limits export tag.
Problem types
-------------
- CWE-409 Improper Handling of Highly Compressed Data (Data
Amplification)
Workarounds
-----------
Apply the patch.
References
----------
https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2/HeaderCompression.pm#L133
https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2/Stream.pm#L414
https://security.metacpan.org/patches/P/Protocol-HTTP2/1.12/CVE-2026-10725-r1.patch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
