Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode. It is absent from the decoder and from the :limits export tag.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-07 | 1 | Disclosure1 |
| 2026-06-11 | 1 | Patch1 |
Perl CPAN CVE-2026-10725: Protocol::HTTP2 through 1.12 is vulnerable to a HTTP/2 Bomb https://www.openwall.com/lists/oss-security/2026/06/06/7 https://x.com/oss_security/status/2063116465641754936
Post summary
The post announces CVE‑2026‑10725, a vulnerability in Protocol::HTTP2 versions up to 1.12 that allows an HTTP/2 bomb attack.
🚨 HIGH SEVERITY: CVE-2026-10725 (CVSS 7.5) Protocol::HTTP2 for Perl <1.13 vulnerable to HTTP/2 Bomb attacks. Small requests can expand into massive memory consumption causing DoS. ✅ Update to v1.13+ immediately #CVE #Vulnerability #PatchNow https://t.co/tQ5ztSDFru
Post summary
The tweet warns of CVE-2026-10725, a high‑severity HTTP/2 bomb DoS vulnerability in Perl's HTTP2 client (CVSS 7.5), and urges users to update to v1.13+ immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | crux | protocol\ | \ | - | - |