CVE-2026-10725

CVE-2026-10725 affects Protocol::HTTP2 for Perl up to version 1.12. The vulnerability stems from the inbound HPACK path having no header-list size limit, allowing a small HTTP/2 request to expand into large server memory (the HTTP/2 bomb). The headers_decode method copies a full key+value per ind...