Bug#1147222: libprotocol-http2-perl: CVE-2026-16028

[Salvatore Bonaccorso]

Source: libprotocol-http2-perl
Version: 1.13-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libprotocol-http2-perl.

CVE-2026-16028[0]:
| Protocol::HTTP2 versions before 1.14 for Perl allow memory
| exhaustion via closed streams that stream_state never removes from
| the connection stream table.  When a stream reaches the CLOSED
| state, stream_state returns the concurrency slot and clears most of
| the stream's keys, but the entry itself stays in the connection
| stream table and nothing in the distribution removes it. Stream
| identifiers increase monotonically, so a peer can open and close
| streams on one connection indefinitely, each close leaving a
| residual entry that is retained for the life of the connection.
| SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting
| caps how many streams are live at once and is enforced, while the
| growth is made of streams the cap has already released, so it
| accumulates with concurrency never exceeding one. The client keeps
| the same table and grows the same way against a hostile server.
| Measured against a server built on this module, roughly 920 bytes
| are retained per closed stream for about 19 bytes on the wire, so
| 100,000 sequential streams on one connection grow server resident
| memory by about 88 MiB. The streams are ordinary requests that the
| application accepts and completes.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-16028
    https://www.cve.org/CVERecord?id=CVE-2026-16028
[1] https://lists.security.metacpan.org/cve-announce/msg/43351225/
[2] https://github.com/vlet/p5-Protocol-HTTP2/commit/27a488a34d74fd16f123e5e6186d4f677faa246f

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore