CVE-2026-10725: Crux Protocol HTTP/2 Bomb DoS Vulnerability

CVE-2026-10725 Overview

CVE-2026-10725 affects Protocol::HTTP2 for Perl in versions before 1.13. The library is vulnerable to an HTTP/2 Bomb attack that exhausts server memory. The inbound HPACK decode path enforces no header-list size limit, so a small HTTP/2 request can expand into very large server memory allocations. The MAX_HEADER_LIST_SIZE value (default 65536) is advertised in SETTINGS frames but never consulted during decoding. This category of weakness is tracked as [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)].

Critical Impact
A remote unauthenticated attacker can send crafted HTTP/2 requests that expand into excessive memory consumption, causing denial of service on any server using Protocol::HTTP2 versions before 1.13.

Affected Products

Crux Protocol::HTTP2 for Perl, all versions prior to 1.13
Protocol::HTTP21.12 (introduced unbounded CONTINUATION buffering in stream_header_block_add)
Perl applications and servers embedding Protocol::HTTP2 as an HTTP/2 transport

Discovery Timeline

2026-06-06 - CVE-2026-10725 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-10725

Vulnerability Analysis

The vulnerability is a header-compression amplification flaw in the HPACK decoder of Protocol::HTTP2. HTTP/2 uses HPACK to compress headers via static and dynamic indexed references. A single small indexed reference in a frame can resolve to a long key and value pair on the server side. The decoder materialises a full key plus value copy for every indexed reference and never compares the accumulated size against any limit.

A related defect exists in stream assembly. Since version 1.12, the stream_header_block_add method appends every CONTINUATION frame to the per-stream header buffer without bounding the total. An attacker can chain many CONTINUATION frames against a single stream and force unbounded buffer growth before decoding completes.

Root Cause

The root cause is the absence of MAX_HEADER_LIST_SIZE enforcement on the receive path. The setting is advertised to peers in SETTINGS frames with a default of 65536 bytes but is not exported in the :limits tag and is not referenced inside headers_decode. Without a running size check during HPACK expansion, compressed headers can decode into payloads orders of magnitude larger than what was received on the wire. See MetaCPAN HeaderCompression.pm and MetaCPAN Stream.pm for the affected code paths.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker establishes an HTTP/2 connection to a server using Protocol::HTTP2 and sends a request whose HEADERS frame, optionally followed by many CONTINUATION frames, references HPACK entries that decode into large strings. The Perl process allocates per-reference copies until memory is exhausted and the service degrades or crashes. Multiple concurrent streams multiply the effect.

Detection Methods for CVE-2026-10725

Indicators of Compromise

Sudden growth in resident memory of Perl processes hosting Protocol::HTTP2 endpoints, followed by OOM kills or worker restarts.
HTTP/2 connections with abnormally high counts of CONTINUATION frames against single streams.
Compressed HEADERS payloads that are small on the wire but produce very large decoded header lists in application logs.

Detection Strategies

Inventory Perl deployments and identify modules using Protocol::HTTP2 with cpanm --info or by scanning @INC for the package.
Compare installed versions against 1.13 and flag any host with an earlier release.
Capture HTTP/2 traffic at the proxy or load balancer and alert on streams exceeding the advertised MAX_HEADER_LIST_SIZE after decoding.

Monitoring Recommendations

Track per-process memory and file descriptor counts for Perl HTTP/2 services and alert on sharp upward trends.
Monitor reverse proxies for HTTP/2 streams with elevated CONTINUATION frame counts or oversized header blocks.
Forward web server and Perl application logs to a centralized analytics platform and correlate restarts with HTTP/2 client IPs.

How to Mitigate CVE-2026-10725

Immediate Actions Required

Upgrade Protocol::HTTP2 to version 1.13 or later on every affected host.
Restart all long-running Perl daemons that loaded the vulnerable module after the upgrade.
Front exposed HTTP/2 endpoints with a reverse proxy that enforces header-list size limits until patching is complete.

Patch Information

The fix is shipped in Protocol::HTTP21.13. Apply the upstream patch from GitHub commit 822bf22 or the MetaCPAN security patch for 1.12. Release notes are tracked in the Protocol-HTTP2 1.13 changes. Additional discussion is available on the Openwall OSS-Security list.

Workarounds

Terminate HTTP/2 at a hardened proxy such as nginx or haproxy that enforces http2_max_field_size, http2_max_header_size, and large_client_header_buffers.
Rate-limit HTTP/2 connections and concurrent streams per source IP at the edge to reduce amplification capacity.
Disable HTTP/2 and serve traffic over HTTP/1.1 on endpoints that cannot be upgraded immediately.

bash

# Configuration example
# Upgrade Protocol::HTTP2 to a fixed release
cpanm Protocol::HTTP2@1.13

# Verify installed version
perl -MProtocol::HTTP2 -e 'print $Protocol::HTTP2::VERSION, "\n"'

# Example nginx limits for HTTP/2 termination
# http2_max_field_size       4k;
# http2_max_header_size      16k;
# large_client_header_buffers 4 8k;