The Protocol::HTTP2 Perl module up to version 1.12 is vulnerable to a memory amplification attack due to improper handling of highly compressed HTTP/2 header data. Specifically, the inbound HPACK decoder does not enforce the MAX_HEADER_LIST_SIZE limit advertised in SETTINGS frames, allowing attackers to send small requests that expand into large memory usage on the server. The headers_decode method materializes full copies of header key-value pairs without size checks, and the stream_header_block_add method appends CONTINUATION frames without limits. This results in unbounded memory consumption, classified under CWE-409 (Improper Handling of Highly Compressed Data). No patch or official remediation has been documented.

An attacker can exploit this vulnerability to cause excessive memory consumption on servers using Protocol::HTTP2 versions through 1.12, potentially leading to denial of service by exhausting server memory resources. There are no known exploits in the wild at this time. The vulnerability does not indicate direct code execution or data leakage but impacts availability through resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by limiting or filtering HTTP/2 traffic to affected servers or disabling HTTP/2 support in Protocol::HTTP2 if feasible. Monitoring for unusually large header blocks may help detect exploitation attempts, but no vendor-provided mitigation or temporary fix is currently documented.