7.5 CVE-2026-10725

Enriched by CISA Patch
 

Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode. It is absent from the decoder and from the :limits export tag.
https://nvd.nist.gov/vuln/detail/CVE-2026-10725

Categories

CWE-409 : Improper Handling of Highly Compressed Data (Data Amplification)
An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
CRUX Protocol::HTTP2
  • < 1.13 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:a:crux:protocol::http2:*:*:*:*:*:perl:*:* < 1.13

REMEDIATION

Patch

Url
https://github.com/vlet/p5-Protocol-HTTP2/commit/822bf22224adbd662e8d0b865eea...
https://security.metacpan.org/patches/P/Protocol-HTTP2/1.12/CVE-2026-10725-r2...

EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry