CVE-2026-16028: CWE-401 Missing Release of Memory after Effective Lifetime

Protocol::HTTP2 versions prior to 1.14 for Perl contain a memory leak vulnerability where closed streams remain in the connection stream table instead of being fully released. Although the concurrency slot is returned and most stream keys are cleared upon closing, the stream entry itself persists for the life of the connection. Since stream identifiers increase monotonically, a peer can open and close streams indefinitely, causing the connection's memory usage to grow without bound. The SETTINGS_MAX_CONCURRENT_STREAMS parameter limits live streams but does not prevent accumulation of closed streams. Testing showed approximately 920 bytes retained per closed stream, leading to substantial memory growth (e.g., 88 MiB for 100,000 sequential streams) without affecting concurrency limits.

This vulnerability can cause a denial of service condition through memory exhaustion on servers using affected versions of Protocol::HTTP2. Attackers can exploit this by repeatedly opening and closing streams on a single connection, causing the server's memory usage to grow significantly over time. There is no impact on confidentiality or integrity, but availability is affected due to resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting the number of streams per connection or implementing connection timeouts to reduce the risk of memory exhaustion. Monitor for updates from the Protocol::HTTP2 maintainers regarding patches or official mitigations.