{"id":"CVE-2026-10725","aliases":["ALPINE-CVE-2026-10725","DEBIAN-CVE-2026-10725","EUVD-2026-34964","GHSA-q432-rmqv-hh8m","SUSE-SU-2026:22188-1","SUSE-SU-2026:2306-1","UBUNTU-CVE-2026-10725","openSUSE-SU-2026:10988-1","openSUSE-SU-2026:21125-1"],"status":"published","title":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00414,"percentile":0.36231,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-409"],"published":"2026-06-06T09:14:45Z","modified":"2026-11-03T06:32:52Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"perl-protocol-http2","fixed_in":["1.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"perl-protocol-http2","fixed_in":["1.14-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libprotocol-http2-perl","fixed_in":["1.12-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-Protocol-HTTP2","fixed_in":["1.10-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-Protocol-HTTP2","fixed_in":["1.10-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Protocol-HTTP2","fixed_in":["1.130.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-Protocol-HTTP2","fixed_in":["1.10-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"perl-protocol-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-protocol-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2","1.10-3","1.11-1","1.12-1","1.12-2","1.13-1","1.14-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11-1","1.12-1","1.12-2","1.13-1","1.14-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2"}]}],"versions":["1.11-1","1.12-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-Protocol-HTTP2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-Protocol-HTTP2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.08-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.09-1","1.10-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libprotocol-http2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Protocol-HTTP2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.130.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Protocol-HTTP2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-160000.3.1"}]}]}],"products":[{"vendor":"crux","product":"protocol::http2"},{"vendor":"crux","product":"protocol\\"}],"references":[{"url":"https://metacpan.org/release/CRUX/Protocol-HTTP2-1.13/changes","tags":["release-notes","Release Notes","advisory"]},{"url":"https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2/HeaderCompression.pm#L133","tags":["Product","web","report"]},{"url":"https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2/Stream.pm#L414","tags":["Product","web","report"]},{"url":"https://github.com/vlet/p5-Protocol-HTTP2/commit/822bf22224adbd662e8d0b865eeacb2b294d16cd.patch","tags":["patch","Patch","fix"]},{"url":"https://security.metacpan.org/patches/P/Protocol-HTTP2/1.12/CVE-2026-10725-r2.patch","tags":["patch","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/06/7","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10725","tags":["advisory"]},{"url":"https://security.metacpan.org/patches/P/Protocol-HTTP2/1.12/CVE-2026-10725-r1.patch","tags":["report"]},{"url":"https://github.com/advisories/GHSA-q432-rmqv-hh8m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-10725","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10725.json","tags":["advisory"]},{"url":"https://github.com/vlet/p5-Protocol-HTTP2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-10725","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622188-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267857","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10725","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262306-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-10725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10725","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40751319/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-10725","title":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T09:14:45.652Z","modified":"2026-06-09T07:20:32.184Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-34964","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T09:14:45Z","modified":"2026-06-09T07:20:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:48.012898Z"}],"ghsa":[{"id":"GHSA-q432-rmqv-hh8m","title":"Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's...","description":"Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T12:31:37Z","modified":"2026-06-09T09:32:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:08:40.238392Z"}],"nvd":[{"id":"CVE-2026-10725","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T10:16:25.79Z","modified":"2026-07-23T07:10:00.113Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"ALPINE-CVE-2026-10725","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T10:16:25.79Z","modified":"2026-11-03T06:32:52.42482076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-10725","title":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.\n\nProtocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").\n\nThe headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.\n\nMAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T09:14:45.652Z","modified":"2026-10-28T02:30:25.288040449Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"DEBIAN-CVE-2026-10725","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb.  Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\").  The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded.  MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T10:16:25.79Z","modified":"2026-10-01T03:01:05.333408846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"UBUNTU-CVE-2026-10725","description":"Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the \"HTTP/2 bomb\"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode.  It is absent from the decoder and from the :limits export tag.","status":"published","published":"2026-06-06T10:16:00Z","modified":"2026-06-12T09:04:03.098187553Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"openSUSE-SU-2026:10988-1","title":"perl-Protocol-HTTP2-1.130.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Protocol-HTTP2-1.130.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-09T00:00:00Z","modified":"2026-06-10T18:24:14.701928847Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21125-1","title":"Security update for perl-Protocol-HTTP2","description":"This update for perl-Protocol-HTTP2 fixes the following issue\n\n- CVE-2026-10725: denial of service due to absence of inbound HPACK header-list size limit (bsc#1267857).\n","status":"published","published":"2026-06-20T06:49:47Z","modified":"2026-06-30T18:24:43.805403436Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22188-1","title":"Security update for perl-Protocol-HTTP2","description":"This update for perl-Protocol-HTTP2 fixes the following issue\n\n- CVE-2026-10725: denial of service due to absence of inbound HPACK header-list size limit (bsc#1267857).\n","status":"published","published":"2026-06-20T06:49:45Z","modified":"2026-06-24T09:00:06.59281352Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2306-1","title":"Security update for perl-Protocol-HTTP2","description":"This update for perl-Protocol-HTTP2 fixes the following issue\n\n- CVE-2026-10725: denial of service due to absence of inbound HPACK header-list size limit (HTTP/2 Bomb attack)\n  (bsc#1267857).\n","status":"published","published":"2026-06-09T07:58:46Z","modified":"2026-06-09T13:15:06.86871299Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}