Your message dated Fri, 11 Sep 2026 15:34:41 +0000
with message-id <[email protected]>
and subject line Bug#1147222: fixed in libprotocol-http2-perl 1.14-1
has caused the Debian Bug report #1147222,
regarding libprotocol-http2-perl: CVE-2026-16028
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147222: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147222
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libprotocol-http2-perl
Version: 1.13-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libprotocol-http2-perl.
CVE-2026-16028[0]:
| Protocol::HTTP2 versions before 1.14 for Perl allow memory
| exhaustion via closed streams that stream_state never removes from
| the connection stream table. When a stream reaches the CLOSED
| state, stream_state returns the concurrency slot and clears most of
| the stream's keys, but the entry itself stays in the connection
| stream table and nothing in the distribution removes it. Stream
| identifiers increase monotonically, so a peer can open and close
| streams on one connection indefinitely, each close leaving a
| residual entry that is retained for the life of the connection.
| SETTINGS_MAX_CONCURRENT_STREAMS does not bound this. That setting
| caps how many streams are live at once and is enforced, while the
| growth is made of streams the cap has already released, so it
| accumulates with concurrency never exceeding one. The client keeps
| the same table and grows the same way against a hostile server.
| Measured against a server built on this module, roughly 920 bytes
| are retained per closed stream for about 19 bytes on the wire, so
| 100,000 sequential streams on one connection grow server resident
| memory by about 88 MiB. The streams are ordinary requests that the
| application accepts and completes.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-16028
https://www.cve.org/CVERecord?id=CVE-2026-16028
[1] https://lists.security.metacpan.org/cve-announce/msg/43351225/
[2]
https://github.com/vlet/p5-Protocol-HTTP2/commit/27a488a34d74fd16f123e5e6186d4f677faa246f
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libprotocol-http2-perl
Source-Version: 1.14-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libprotocol-http2-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libprotocol-http2-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 11 Sep 2026 17:15:34 +0200
Source: libprotocol-http2-perl
Architecture: source
Version: 1.14-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1147222
Changes:
libprotocol-http2-perl (1.14-1) unstable; urgency=medium
.
* Import upstream version 1.14.
- security fix: CVE-2026-16028 - memory exhaustion, a remote
denial-of-service
Closes: #1147222
* Convert debian/watch to version 5.
Checksums-Sha1:
83d8020fbff4f8043a43bb3c8a3160f5df26e99b 2594 libprotocol-http2-perl_1.14-1.dsc
d7aaefeb3be208f2848abe1de237e492ee0fd7ed 53737
libprotocol-http2-perl_1.14.orig.tar.gz
650fab1f8ad282dfecb21044081aee1f4b20f1f9 2732
libprotocol-http2-perl_1.14-1.debian.tar.xz
2a94c9dd23c3fc98da479252b89e12c36ed2fb8e 119036
libprotocol-http2-perl_1.14-1.git.tar.xz
8d1e438655cf17f5b33c287dd9fa05dbef7637b0 17724
libprotocol-http2-perl_1.14-1_source.buildinfo
Checksums-Sha256:
92e52c5f87a4a296f8fb8ae26f1fb37148fbb03b4a1a30ec2896b03db2373c79 2594
libprotocol-http2-perl_1.14-1.dsc
a53f27ea2fbac156a4cd4981d8ef749c1bef366c2909134b4d31da21644b496e 53737
libprotocol-http2-perl_1.14.orig.tar.gz
6abd89038c602d589a7ee95c60aaa0e9f8efe39364b38ab5b16b154007fff3f6 2732
libprotocol-http2-perl_1.14-1.debian.tar.xz
1972bfc37054e3c39abfb073f3104ce550b56f311eed6ebdb949e48151ecae0b 119036
libprotocol-http2-perl_1.14-1.git.tar.xz
fc7e2771abd3c5d3ade78417a965b1cc867703077f8e35cfe503dcd987317410 17724
libprotocol-http2-perl_1.14-1_source.buildinfo
Files:
57e6035aa0f389ac7fc6a51ab1a0ee41 2594 perl optional
libprotocol-http2-perl_1.14-1.dsc
5f4876f14cd08a5e254d58428a856022 53737 perl optional
libprotocol-http2-perl_1.14.orig.tar.gz
f23ae01ec8df6fcda29274fbbde542c9 2732 perl optional
libprotocol-http2-perl_1.14-1.debian.tar.xz
63f5c9e64d27fd3ef9a7d1bbc65a632d 119036 perl None
libprotocol-http2-perl_1.14-1.git.tar.xz
5fe3929f2fc23e3e70294f5a477d834d 17724 perl optional
libprotocol-http2-perl_1.14-1_source.buildinfo
Git-Tag-Info: tag=21e34d5ccbd577311597643061bfc2a7e1991b54
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqkG9cACgkQYG0ITkaD
wHm3RBAAzjRneQto/Q2RUF/x+WZ/tafsFDhjERk8Xaxen/MHXvltcCPO8A9sbXsD
8J6tBUsyIBL4jMNY0beMrYLboDc/fC08o1WD0vJNDvUhFZxBt7456jGt31P2B+uC
6tsgrBfY9YeZ9u0BS9SZqUacw0cGT3ma7MVIQYNYWF5SzuFWbnL8dsoQnFLltL6/
l/70I4fxiZn4p1Z6d2iSUGsCb1IffcJ1+Zuhq5Cn4ys/lG9ymernR1k6hYmGQeBP
AyFtFkHDovJ+1Z7Ew8kVQ7yyXJ4DSbGUvFfVzu1GTB9i+TwvKuRzSv0NqVr18LDI
12cBOVJLmLmOcTANXTiMx1QbxM6hmaQRr1TApIT/WMW5wZ9vgtlI16r11AJSr05V
BrngWzT4IeQq540J8CSGyoSul3qWxEfeAn2BKXRo9rHeeH8IGwxMbhMvMqRlIUWu
SJwtKirxeS/i7ljv/WBjYpQJsc8klJUQy8MeZ86GTraxk/WLt4aGCGfHdj6cYlZI
z0F4Ma0Y4vRahwINd2p2mKW0Ddtki4q4N2Wqk8uFJ0/yvK14Xr7UJvzVrx8iSSu2
KNneRVZNa3nLzV+PAQkEwOPc5rjsqurwYMrpj0K0MQAx+mBEi9oRVcttxto/subS
6JAzt/u1r3zijrFPBQyo6aHTWUx5YsVnJPK2dX4RPnTkfmiqOSA=
=E49Y
-----END PGP SIGNATURE-----
pgpslFue0iSiE.pgp
Description: PGP signature
--- End Message ---
