A memory exhaustion vulnerability in the Perl Protocol::HTTP2 module allows unauthenticated attackers to cause server instability by indefinitely opening and closing streams.

This vulnerability involves a failure to release memory after a stream reaches the CLOSED state, leading to residual entries remaining in the connection stream table. An unauthenticated attacker can exploit this by repeatedly opening and closing streams to consume server memory, as the accumulation is not bounded by the SETTINGS_MAX_CONCURRENT_STREAMS configuration.

The exploitation of this flaw can lead to significant memory consumption, potentially resulting in a Denial of Service (DoS) condition where the affected server becomes unresponsive or crashes due to resource exhaustion. With a CVSS score of 7.5, this high severity vulnerability poses a direct risk to system availability and service continuity for applications relying on this library.

Immediate Action: Update the Protocol::HTTP2 package to version 1.14 or later to implement the memory cleanup fix.

Proactive Monitoring: Monitor server memory usage and connection counts for unusual patterns that may indicate automated stream-based exhaustion attempts.

Compensating Controls: If immediate patching is not feasible, implement a configuration to close connections after a fixed number of requests to force the discarding of the stream table.

Public Exploit Available: No (exploit_available: false)

Given the high severity and the potential for service disruption, organizations should prioritize upgrading to version 1.14. The ease of triggering this memory accumulation makes it a priority for environments exposed to untrusted traffic.