CVE-2026-10725

Name of the Vulnerable Software and Affected Versions Protocol::HTTP2 versions prior to 1.13

Description The software is susceptible to an HTTP/2 Bomb, where a small request can expand into large server memory consumption. This occurs because the inbound HPACK path lacks a header-list size limit. Specifically, the headers decode() function creates a full key and value copy for each indexed reference without performing a size check. Additionally, the stream header block add() function appends every CONTINUATION frame to the per-stream buffer without bounds. Although the MAX HEADER LIST SIZE setting is advertised, it is not consulted during the decoding process.

Recommendations Update to a version later than 1.12.