Fedora 43 : perl-Protocol-HTTP2 (2026-4c8da3ad64)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4c8da3ad64 advisory. This release fixes CVE-2026-10725 exhausting memory when decompressing request headers. It also improves examples. Tenable has extracted the precedi...

CVE-2026-10725

The Protocol::HTTP2 Perl module (versions before 1.13 ) is vulnerable to an HTTP/2 Bomb attack. The root cause is that the inbound HPACK path lacks a header-list size limit, allowing a small HTTP/2 request to expand into large amounts of server memory. Specifically, the headers_decode method crea...