Source: libprotocol-http2-perl Version: 1.13-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for libprotocol-http2-perl. CVE-2026-16028[0]: | Protocol::HTTP2 versions before 1.14 for Perl allow memory | exhaustion via closed streams that stream_state never removes from | the connection stream table. When a stream reaches the CLOSED | state, stream_state returns the concurrency slot and clears most of | the stream's keys, but the entry itself stays in the connection | stream table and nothing in the distribution removes it. Stream | identifiers increase monotonically, so a peer can open and close | streams on one connection indefinitely, each close leaving a | residual entry that is retained for the life of the connection. | SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting | caps how many streams are live at once and is enforced, while the | growth is made of streams the cap has already released, so it | accumulates with concurrency never exceeding one. The client keeps | the same table and grows the same way against a hostile server. | Measured against a server built on this module, roughly 920 bytes | are retained per closed stream for about 19 bytes on the wire, so | 100,000 sequential streams on one connection grow server resident | memory by about 88 MiB. The streams are ordinary requests that the | application accepts and completes. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-16028 https://www.cve.org/CVERecord?id=CVE-2026-16028 [1] https://lists.security.metacpan.org/cve-announce/msg/43351225/ [2] https://github.com/vlet/p5-Protocol-HTTP2/commit/27a488a34d74fd16f123e5e6186d4f677faa246f Please adjust the affected versions in the BTS as needed. Regards, Salvatore
