[From nobody Fri Sep 11 16:37:06 2026
Received: (at submit) by bugs.debian.org; 9 Sep 2026 18:38:18 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-11.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
 MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 25; hammy, 150; neutral, 87; spammy,
 0. spammytokens: hammytokens:0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug,
 0.000-+--HTo:N*Debian
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1x4NBY-00ENDG-0B
 for submit@bugs.debian.org; Wed, 09 Sep 2026 18:38:17 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: libprotocol-http2-perl: CVE-2026-16028
Message-ID: <178897909279.2196210.13301399961246955769.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0+nmu1
Date: Wed, 09 Sep 2026 20:38:12 +0200
Delivered-To: submit@bugs.debian.org

Source: libprotocol-http2-perl
Version: 1.13-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for libprotocol-http2-perl.

CVE-2026-16028[0]:
| Protocol::HTTP2 versions before 1.14 for Perl allow memory
| exhaustion via closed streams that stream_state never removes from
| the connection stream table.  When a stream reaches the CLOSED
| state, stream_state returns the concurrency slot and clears most of
| the stream's keys, but the entry itself stays in the connection
| stream table and nothing in the distribution removes it. Stream
| identifiers increase monotonically, so a peer can open and close
| streams on one connection indefinitely, each close leaving a
| residual entry that is retained for the life of the connection.
| SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting
| caps how many streams are live at once and is enforced, while the
| growth is made of streams the cap has already released, so it
| accumulates with concurrency never exceeding one. The client keeps
| the same table and grows the same way against a hostile server.
| Measured against a server built on this module, roughly 920 bytes
| are retained per closed stream for about 19 bytes on the wire, so
| 100,000 sequential streams on one connection grow server resident
| memory by about 88 MiB. The streams are ordinary requests that the
| application accepts and completes.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-16028
    https://www.cve.org/CVERecord?id=CVE-2026-16028
[1] https://lists.security.metacpan.org/cve-announce/msg/43351225/
[2] https://github.com/vlet/p5-Protocol-HTTP2/commit/27a488a34d74fd16f123e5e6186d4f677faa246f

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]