Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode. It is absent from the decoder and from the :limits export tag.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22188-1 advisory.

    This update for perl-Protocol-HTTP2 fixes the following issue

    - CVE-2026-10725: denial of service due to absence of inbound HPACK header-list size limit (bsc#1267857).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4c8da3ad64 advisory.

    This release fixes CVE-2026-10725 (exhausting memory when decompressing request headers). It also improves     examples.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-12765c0719 advisory.

    This release fixes CVE-2026-10725 (exhausting memory when decompressing request headers). It also improves     examples.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:2306-1 advisory.

    This update for perl-Protocol-HTTP2 fixes the following issue

    - CVE-2026-10725: denial of service due to absence of inbound HPACK header-list size limit (HTTP/2 Bomb     attack)       (bsc#1267857).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound     HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory     (the HTTP/2 bomb). The headers_decode method materialises a full key+value copy per indexed reference     with no running size check, and the stream_header_block_add method appends (since version 1.12) every     CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised     in SETTINGS but never consulted on decode. It is absent from the decoder and from the :limits export tag.
    (CVE-2026-10725)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323074	SUSE SLES16 Security Update : perl-Protocol-HTTP2 (SUSE-SU-2026:22188-1)	Nessus	SuSE Local Security Checks	high
321472	Fedora 43 : perl-Protocol-HTTP2 (2026-4c8da3ad64)	Nessus	Fedora Local Security Checks	high
321440	Fedora 44 : perl-Protocol-HTTP2 (2026-12765c0719)	Nessus	Fedora Local Security Checks	high
321034	SUSE SLES15 Security Update : perl-Protocol-HTTP2 (SUSE-SU-2026:2306-1)	Nessus	SuSE Local Security Checks	high
319610	Linux Distros Unpatched Vulnerability : CVE-2026-10725	Nessus	Misc.	high

Detections

Analytics

CVE-2026-10725

high

Tenable Plugins

high

high

high

high

high