CVE-2026-10725: Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb

Synopsis

This is a denial-of-service vulnerability (HTTP/2 bomb) in the Perl module Protocol::HTTP2 before version 1.13. A remote attacker with no authentication can send a small, specially crafted HTTP/2 request that expands into a large amount of server memory during HPACK header decompression, because the library advertises a MAX_HEADER_LIST_SIZE limit in SETTINGS but never enforces it during decoding and appends CONTINUATION frames to a per-stream buffer without any size check. Successful exploitation exhausts server memory and crashes or hangs the affected service. A patched-image rebuild at version 1.13 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the HTTP/2 service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials or account are needed; the malicious request can be sent by any unauthenticated client.

• Victim interactionNot required

  No user action is required; the server processes the incoming request automatically.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are needed to trigger the unbounded memory expansion.

Blast Radius

• The targeted service exhausts available server memory as the HPACK decoder materialises unbounded copies of header key-value pairs from a single small request.
• Unbounded CONTINUATION frame accumulation per stream compounds the memory growth, accelerating resource exhaustion under repeated or pipelined requests.
• The affected process crashes or becomes unresponsive, taking down any HTTP/2 endpoints served by the application.
• No confidentiality or data integrity impact is present; the sole impact is availability loss of the affected service.