CVE-2026-16028
Description
A flaw was found in Protocol::HTTP2 for Perl. A remote attacker could exploit this vulnerability by repeatedly opening and closing HTTP/2 streams. This action causes the system to retain residual entries for each closed stream, leading to an unbounded increase in memory usage. This memory exhaustion can result in a Denial of Service (DoS) for the affected system.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can cause severe service denial through continuous memory exhaustion across a single long-lived connection. Standard HTTP/2 stream concurrency controls fail to limit the retained connection table growth, allowing ordinary sequential requests to gradually deplete system memory. While the flaw poses a significant availability risk to networked Perl services using this library, the package is not shipped in default Red Hat Enterprise Linux runtime installations.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
