CVE-2026-16028 is a vulnerability in Protocol::HTTP2 versions before 1.14 for Perl, which allows memory exhaustion via closed streams that are not removed from the connection stream table. This issue arises because when a stream reaches the CLOSED state, its entry remains in the connection stream table, leading to potential memory growth as streams are opened and closed. The SETTINGS_MAX_CONCURRENT_STREAM [truncated]
CVE-2026-10725 is a HIGH severity vulnerability in Protocol::HTTP2, a Perl module for HTTP/2 protocol implementation. The vulnerability allows for an HTTP/2 'bomb' attack, which can cause a small HTTP/2 request to expand into large server memory. This is due to the lack of a header-list size limit in the inbound HPACK path, and the unbounded appending of CONTINUATION frames to the per-stream buffer. The v [truncated]
