Protocol::HTTP2 versions prior to 1.14 for Perl fail to release memory for closed streams because the stream_state function removes concurrency slots and clears most stream keys but leaves the stream entry in the connection stream table. Since stream identifiers increase monotonically and the entries are never removed, a peer can open and close streams repeatedly on a single connection, causing the connection's stream table to grow indefinitely. The SETTINGS_MAX_CONCURRENT_STREAMS setting only limits live streams, not the accumulation of closed streams. This results in memory exhaustion as each closed stream retains approximately 920 bytes, leading to substantial memory growth (e.g., about 88 MiB for 100,000 sequential streams).

An attacker or hostile peer can cause memory exhaustion on a server using affected versions of Protocol::HTTP2 by repeatedly opening and closing streams on a single connection. This leads to unbounded memory growth on the server, potentially degrading performance or causing denial of service due to resource exhaustion. The vulnerability does not affect concurrency limits and can be exploited without exceeding live stream caps.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the lifetime or number of streams per connection at the application level or using external controls to mitigate memory growth. Monitor for updates from the Protocol::HTTP2 maintainers regarding an official fix.