Protocol::HTTP2’s inbound HPACK path does not enforce a header‑list size limit, allowing a small HTTP/2 request to inflate into a large amount of server memory. The headers_decode method creates a full key‑value copy for each indexed reference without running size checks, and the stream_header_block_add method appends every CONTINUATION frame without bounding the per‑stream buffer. Because the advertised MAX_HEADER_LIST_SIZE setting is never consulted, an attacker can send a crafted request that consumes excessive memory, potentially leading to a server crash or denial of service. This uncontrolled resource consumption aligns with CWE‑409.

The vulnerable component is CRUX’s Protocol::HTTP2 module. Versions up to and including 1.12 are affected; later releases have not been listed as impacted. Administrators should review the Perl module version in use and ensure it is newer than 1.12 or has the patch applied.

The vulnerability is remotely exploitable over HTTP/2, requiring only that an attacker be able to send HTTP/2 traffic to the affected server. No special network privilege is required, making the attack straightforward. The immediate consequence is memory exhaustion, which can degrade availability. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the lack of size controls and the high impact of a denial of service warrant close attention. An attacker could exploit this simply by initiating a HTTP/2 connection and sending a sequence of headers that triggers the oversized buffer growth.