Protocol::HTTP2 versions before 1.13 for Perl are vulnerable to a HTTP/2 bomb because the inbound HPACK decoder does not enforce a header‑list size limit. A small request can inflate into a large server memory allocation. The headers_decode subroutine materialises a full key+value copy for each indexed reference without a running size check, while stream_header_block_add appends every CONTINUATION frame to the per‑stream buffer unbounded. Since the advertised MAX_HEADER_LIST_SIZE setting is never consulted during decoding, an attacker can send a crafted header payload that consumes excessive memory, potentially causing a crash or denial of service. This uncontrolled resource consumption reflects CWE‑409.

The vulnerable component is CRUX’s Protocol::HTTP2 module. Versions up to and including 1.12 are affected; later releases have not been listed as impacted. Administrators should review the Perl module version in use and ensure it is newer than 1.12 or has the patch applied.

The vulnerability is remotely exploitable over HTTP/2, requiring only that an attacker be able to send HTTP/2 traffic to the affected server. No special network privilege is required, making the attack straightforward. The immediate consequence is memory exhaustion, which can degrade availability. The EPSS score of 0.00018 indicates a very low but non‑zero exploitation probability, and the issue is not listed in CISA’s KEV catalog. An attacker could exploit this simply by initiating a HTTP/2 connection and sending a sequence of headers that triggers the oversized buffer growth.