Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state returns the concurrency slot and clears most of the stream's keys, but the entry itself stays in the connection stream table and nothing in the distribution removes it. Stream identifiers increase monotonically, so a peer can open and close streams on one connection indefinitely, each close leaving a residual entry that is retained for the life of the connection. SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting caps how many streams are live at once and is enforced, while the growth is made of streams the cap has already released, so it accumulates with concurrency never exceeding one. The client keeps the same table and grows the same way against a hostile server. Measured against a server built on this module, roughly 920 bytes are retained per closed stream for about 19 bytes on the wire, so 100,000 sequential streams on one connection grow server resident memory by about 88 MiB. The streams are ordinary requests that the application accepts and completes.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4182-1 advisory.

    This update for perl-Protocol-HTTP2 fixes the following issue:

    - CVE-2026-16028: memory exhaustion leading to denial of service due to closed streams never being removed     by       `stream_state` from the connection stream table (bsc#1279629).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-06b545f607 advisory.

    This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and  a license     wording.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-038229756e advisory.

    This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and  a license     wording.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e06691a7c4 advisory.

    This release fixes CVE-2026-16028 (a memory exhaustion causing a denial of service) and  a license     wording.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state     never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state     returns the concurrency slot and clears most of the stream's keys, but the entry itself stays in the     connection stream table and nothing in the distribution removes it. Stream identifiers increase     monotonically, so a peer can open and close streams on one connection indefinitely, each close leaving a     residual entry that is retained for the life of the connection. SETTINGS_MAX_CONCURRENT_STREAMS does not     bound this. That setting caps how many streams are live at once and is enforced, while the growth is made     of streams the cap has already released, so it accumulates with concurrency never exceeding one. The     client keeps the same table and grows the same way against a hostile server. Measured against a server     built on this module, roughly 920 bytes are retained per closed stream for about 19 bytes on the wire, so     100,000 sequential streams on one connection grow server resident memory by about 88 MiB. The streams are     ordinary requests that the application accepts and completes. (CVE-2026-16028)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346226	SUSE SLES15 Security Update : perl-Protocol-HTTP2 (SUSE-SU-2026:4182-1)	Nessus	SuSE Local Security Checks	Local	high
345823	Fedora 43 : perl-Protocol-HTTP2 (2026-06b545f607)	Nessus	Fedora Local Security Checks	Local	high
345759	Fedora 45 : perl-Protocol-HTTP2 (2026-038229756e)	Nessus	Fedora Local Security Checks	Local	high
345751	Fedora 44 : perl-Protocol-HTTP2 (2026-e06691a7c4)	Nessus	Fedora Local Security Checks	Local	high
343536	Linux Distros Unpatched Vulnerability : CVE-2026-16028	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-16028

high

Tenable Plugins

high

high

high

high

high