CVE-2026-16028: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-16028 is a memory exhaustion (Denial of Service) vulnerability in the Perl module Protocol::HTTP2 affecting all versions before 1.14. The flaw allows an unauthenticated remote attacker to cause unbounded memory growth on a server (or client) by repeatedly opening and closing HTTP/2 streams on a single connection, as closed stream entries are never removed from the connection stream table. It was disclosed on September 7, 2026 by the CPAN Security Group via the oss-security mailing list and the GitHub Advisory Database. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, oss-security).

The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): when an HTTP/2 stream transitions to the CLOSED state, the stream_state function in lib/Protocol/HTTP2/Stream.pm returns the concurrency slot and clears most stream keys, but the stream entry itself is never removed from the connection's stream hash table (oss-security). Because HTTP/2 stream identifiers increase monotonically, an attacker can serially open and close streams indefinitely on a single persistent connection, each leaving a ~920-byte residual entry. The SETTINGS_MAX_CONCURRENT_STREAMS setting does not mitigate this because it only caps simultaneously live streams, not the accumulation of already-closed ones — meaning the attack can proceed with a concurrency of one. The fix (commit 27a488a) introduces a bounded closed_streams queue (default cap: 65,535 entries) and evicts the oldest entries when the cap is exceeded (GitHub Patch).

Successful exploitation causes continuous, unbounded growth of server (or client) resident memory for the lifetime of the connection. At the measured rate of ~920 bytes retained per closed stream against ~19 bytes of wire traffic, 100,000 sequential streams on one connection consume approximately 88 MiB of RAM (GitHub Advisory). There is no confidentiality or integrity impact; the sole consequence is availability loss — the affected process can be driven to memory exhaustion, potentially crashing the service or degrading performance for all users sharing the server.

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment marks the vulnerability as automatable with no known exploitation. The EPSS score is approximately 0.21% (0.0021), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the low exploit complexity (no authentication or user interaction required), the attack requires a persistent HTTP/2 connection and produces gradual rather than immediate impact.

1. Identify a target: Locate a server running a Perl application that uses Protocol::HTTP2 versions before 1.14 (e.g., via HTTP/2 fingerprinting or banner analysis).
2. Establish a persistent HTTP/2 connection: Open a single long-lived HTTP/2 connection to the target server using any HTTP/2-capable client (e.g., h2load, curl --http2, or a custom script).
3. Serially open and close streams: Send a sequence of ordinary HTTP/2 requests (e.g., GET or POST), each on a new stream ID, and allow each to complete normally. Stream IDs increment monotonically (1, 3, 5, …), so each completed request leaves a residual ~920-byte entry in the server's stream table.
4. Sustain the attack: Continue sending requests without closing the connection. With 100,000 streams, approximately 88 MiB of server RAM is consumed. Scaling to millions of streams on one or more connections can exhaust available memory.
5. Achieve denial of service: The server process runs out of memory, causing crashes, OOM kills, or severe performance degradation for all users (oss-security, GitHub Patch).

• Network: A single client IP maintaining an unusually long-lived HTTP/2 connection with a very high number of sequential stream IDs (thousands to millions) while keeping concurrency at or near one; high request rate from one source with minimal payload size (~19 bytes per stream on the wire.
• Process/Memory: Steady, monotonically increasing RSS (resident set size) of the Perl server process over the lifetime of a single connection, not correlated with legitimate traffic volume; OOM killer events (oom_kill_process) in system logs targeting the Perl application.
• Logs: Application or access logs showing an extremely large number of completed requests from a single persistent connection/IP with incrementing HTTP/2 stream IDs and no corresponding increase in response data volume; server error logs indicating memory allocation failures.

The primary remediation is to upgrade Protocol::HTTP2 to version 1.14 or later, which introduces a bounded closed-stream queue (default cap: 65,535 entries) that evicts the oldest entries when exceeded (GitHub Patch, MetaCPAN). For deployments that cannot upgrade immediately, the official workaround is to close each HTTP/2 connection after a fixed number of requests, which discards the accumulated stream table (oss-security). Additionally, consider implementing rate limiting on stream creation per connection, setting connection timeouts, and monitoring server memory usage for abnormal growth patterns. The max_closed_streams option introduced in 1.14 can also be tuned to a lower value if memory constraints are tight.

The vulnerability was responsibly disclosed by Robert Rothenberg of the CPAN Security Group (CPANSec) via the oss-security mailing list on September 7, 2026, with a clear technical description and workaround guidance (oss-security). OpenSUSE issued a security announcement for the affected package, and Fedora issued an advisory for perl-Protocol-HTTP2, indicating downstream Linux distribution uptake of the fix. Coverage has been limited to security aggregators and Linux distribution security channels, with no notable broader media or social media discussion observed.