Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library allows memory corruption when a client receives a crafted sequence of HTTP/2 HEADERS frames. This double‑free flaw can lead to arbitrary code execution on the client, compromising confidentiality, integrity, and availability. The weakness is identified as CWE‑415.

AWS provides the aws-c-http library used by applications that implement HTTP/2. Versions prior to 0.11.0 include the unsafe handling of HPACK table size updates. Anyone integrating an older release of aws-c-http into a client application is vulnerable; the vulnerability is triggered by a server that supplies malicious HTTP/2 frames.

The CVSS score of 8.7 marks the flaw as High severity. Because the exploit requires only a malicious server communicating over HTTP/2, it is remotely exploitable without local privileges. The exploit probability cannot be quantified via EPSS as it is not available, and the vulnerability is not listed in CISA KEV. The risk is therefore significant for any client that accepts connections from potentially untrusted servers, and the likelihood of exploitation is high in environments where such connections are common.