The Protocol::HTTP2 Perl module prior to version 1.13 is vulnerable to a denial-of-service condition due to improper handling of highly compressed HTTP/2 headers (CWE-409). Specifically, the inbound HPACK decoding path does not enforce the MAX_HEADER_LIST_SIZE limit advertised in SETTINGS, allowing an attacker to send a small request that expands into a large memory allocation (the HTTP/2 bomb). The headers_decode method creates full copies of keys and values for indexed references without size checks, and from version 1.12, the stream_header_block_add method appends every CONTINUATION frame to the per-stream buffer without bounds. This unbounded memory consumption can lead to resource exhaustion and service disruption.

This vulnerability can be exploited remotely without authentication (AV:N/AC:L/PR:N/UI:N) to cause a denial of service by exhausting server memory (Availability impact: High). There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, consider limiting or filtering HTTP/2 traffic from untrusted sources or applying external protections to mitigate potential memory exhaustion attacks.