CVE-2026-16028

Executive Summary

CVE-2026-16028 is a memory exhaustion vulnerability in the Perl Protocol::HTTP2 module affecting all versions prior to 1.14. The flaw allows a remote peer (client or server) to indefinitely grow process memory by opening and closing HTTP/2 streams on a single connection, because closed stream entries are never removed from the connection stream table. Applications exposing HTTP/2 endpoints built on this module are susceptible to denial-of-service via memory exhaustion; roughly 88 MiB of server memory is consumed per 100,000 sequential streams, with no concurrency limit capable of bounding the growth. As of this report, no patch is publicly available from any tracked source.

Technical Analysis

The vulnerability resides in the stream lifecycle management of the Protocol::HTTP2 Perl module (all versions before 1.14). The NVD description provides the following mechanism details:

Core Flaw. When an HTTP/2 stream transitions to the CLOSED state, the internal function referenced as stream_state performs two actions: it returns the concurrency slot allocated to that stream and clears most of the stream's stored keys. However, the entry itself is not removed from the connection's stream table. No other code path in the module's distribution deletes these residual entries. The table therefore accumulates one dead entry per closed stream for the entire lifetime of the connection.

Growth Vector. HTTP/2 stream identifiers increase monotonically. A peer can open a stream, let it complete (or reset it) to reach CLOSED, and repeat indefinitely on the same connection. Each iteration leaves a residual table entry. The SETTINGS_MAX_CONCURRENT_STREAMS parameter does not bound this growth — that setting caps only the number of simultaneously live streams, which is enforced correctly. The memory growth is composed of streams whose concurrency slot has already been returned, so an attacker can keep concurrency at or below one while the table grows without limit.

Bidirectional Exposure. The NVD description explicitly notes that a client built on this module grows its table the same way when interacting with a hostile server. This makes the flaw exploitable in both directions — a malicious server can exhaust a client's memory, and a malicious client can exhaust a server's memory.

Quantified Impact. Measurements taken against a server built on the module show approximately 920 bytes retained per closed stream at a wire cost of roughly 19 bytes per stream request. 100,000 sequential streams over one connection grow resident memory by approximately 88 MiB. The NVD description stresses that these streams are ordinary requests that the application accepts and completes normally — no malformed traffic or protocol violation is required.

The root cause classifies under CWE-401: Improper Release of Memory Before Removing Last Reference ('Memory Leak') — the module fails to release the table entry reference when the stream object is logically destroyed.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2026-16028. The attack chain below is inferred strictly from the NVD description's mechanism details.

Scenario 1 — Server-Side Memory Exhaustion (Primary):

1. Reconnaissance/Target Identification: An attacker identifies an Internet-facing HTTP/2 endpoint. Fingerprinting can be performed by observing HTTP/2 SETTINGS frames and stream behavior; applications built on Perl's Protocol::HTTP2 module respond with characteristic frame ordering. The target need not be a custom application — any service using the module in an HTTP/2 server capacity is vulnerable.

2. Flaw Trigger: The attacker opens a single TCP/TLS connection and performs HTTP/2 protocol negotiation (prior knowledge or ALPN). Once the connection is established, the attacker sends a stream creation frame (HEADERS) for stream N, waits for the application to process and complete the request (stream transitions to CLOSED), then opens stream N+2, N+4, and so on. Critically, the attacker respects SETTINGS_MAX_CONCURRENT_STREAMS — never exceeding one concurrent stream — so no protocol violation occurs.

3. Execution Method: The attack is purely volumetric at the application layer. Each request is a legitimate, well-formed HTTP/2 request (e.g., GET /). The attacker loops sequentially: complete request → stream closes → open next stream. No payload is required beyond ordinary HTTP traffic. At roughly 19 bytes on the wire per stream, the bandwidth cost to the attacker is minimal (≈2 MB to trigger ~88 MiB of server memory growth).

4. Post-Exploitation Impact: Each request consumes ~920 bytes of unreclaimable server memory. Sustained traffic over hours or days exhausts available process memory. The affected process becomes unstable, may be killed by the OS OOM killer, or enters a state where legitimate requests fail due to memory allocation failures — resulting in denial of service for all users of the service.

Scenario 2 — Client-Side Memory Exhaustion (Reverse):

The NVD description confirms a client using the module maintains the same stream table and grows it identically against a hostile server. A malicious server can push or respond to client requests in a way that forces rapid stream closure cycles, exhausting the client application's memory. This primarily affects long-lived client connections (e.g., persistent API clients, daemons consuming streaming data).

Impact Assessment

Business Impact: High for organizations running HTTP/2 services on Perl-based stacks using Protocol::HTTP2. Because 100% of stream completions leak memory with no cap, any production service with sustained connection churn is at risk. The attack requires no elevated privileges, no authentication bypass, and no malformed packets — making it difficult to distinguish from legitimate high-volume traffic in simple rate-based monitoring.

Affected Systems: Any server or client application using Protocol::HTTP2 versions before 1.14. This includes web servers, reverse proxies, and API gateways implemented in Perl with HTTP/2 support. Applications behind such components that terminate HTTP/2 via this module are equally exposed.

Blast Radius: Moderate to High. The vulnerability is network-triggerable without authentication. However, the lack of a known patch (confidence 0/4) and no vendor advisory at the time of writing suggests limited awareness and thus limited active exploitation. If the module is widely deployed (it is a dependency for some HTTP/2 Perl frameworks), the potential victim base is broad. The cumulative memory growth rate (~88 MiB per 100k requests) demands sustained traffic over time rather than a single-burst attack, giving defenders a window for detection.

CVSS Context: No CVSS score has been assigned by the CNA. Based on the attack mechanics — network-accessible, low complexity, no privileges required, no user interaction, availability impact only — a qualitative assessment of High severity is appropriate, though this remains N/A in official scoring until the CNA publishes.

Detection Guidance

Sigma Rule

title: HTTP/2 Stream Table Memory Exhaustion Attempt - High Stream Closure Rate
id: 3a8f2c9e-7b41-4d2a-9f5c-1e6b8a0d4c72
status: experimental
description: Detects a single HTTP/2 connection generating an abnormally high number of sequentially closed streams, indicative of CVE-2026-16028 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16028
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: perl
detection:
    selection:
        http2.stream_id|endswith: "0"  # even number - server-initiated; adjust for client-initiated (odd)
        http2.state: "closed"
    condition: selection
    timeframe: 5m
    aggregation:
        group_by: http2.connection_id
        count(http2.stream_id) > 5000
falsepositives:
    - Legitimate load testing tools opening many short-lived requests
    - Very active clients running automated polling
level: medium
tags:
    - attack.t1190
    - cve.2026-16028
    - cwe.401

YARA Rule

rule CVE_2026_16028_Protocol_HTTP2_Memory_Exhaustion
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-15"
        description = "Detects indicators of CVE-2026-16028 in Perl Protocol::HTTP2 source or memory artifacts"
        cve = "CVE-2026-16028"
        cwe = "CWE-401"
        severity = "high"
    strings:
        // Look for the stream table handling pattern described in NVD - entry persistence on closure
        $s1 = "stream_state" ascii
        $s2 = "closed" ascii wide
        $s3 = "concurrency" ascii
        $s4 = "SETTINGS_MAX_CONCURRENT_STREAMS" ascii
        $a1 = "Protocol::HTTP2" ascii

        // look for known module version markers < 1.14
        $v1 = "VERSION = '1.13'" ascii
        $v2 = "Version 1.13" ascii
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464c457f // PE or ELF memory dump
        and filesize < 10MB
        and $a1 and 1 of ($s*)
        and any of ($v*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-16028 Potential HTTP/2 Stream Exhaustion - Excessive Streams on Single Connection"; flow:established,to_server; http2.stream_id; content:"|01|"; http2.stream_state; content:"closed"; threshold:type both, track by_src, count 10000, seconds 60; classtype:attempted-dos; sid:2026160281; rev:1; metadata:cve CVE-2026-16028, cwe CWE-401, attack_tactic T1190;)

Note: Suricata's HTTP/2 inspection keywords (http2.stream_id etc.) are runtime-dependent. This rule represents a model for detecting the stream count threshold; adapt keyword syntax to the deployed Suricata version.

Elastic Detection

// EQL - Detect single connection with excessive stream closings within a window
sequence by destination.ip, source.ip with maxspan=5m
    [ network where network.protocol == "http2" and http2.stream_id % 2 != 0 ]
    [ network where network.protocol == "http2" and http2.stream_id % 2 != 0 ]
    [ network where network.protocol == "http2" and http2.stream_id % 2 != 0 ]
    [ network where network.protocol == "http2" and http2.stream_id % 2 != 0 ]
    [ network where network.protocol == "http2" and http2.stream_id % 2 != 0 ]
    // extend pattern to reach 100+ events per connection

Splunk SPL Query

index=proxy OR index=webserver http2_state="closed"
| bin _time span=5m
| stats count as stream_closed_count by _time, src_ip, dest_ip, http2_conn_id
| where stream_closed_count > 10000
| eval estimated_mem_leak_mb = round(stream_closed_count * 920 / 1024 / 1024, 2)
| table _time, src_ip, dest_ip, http2_conn_id, stream_closed_count, estimated_mem_leak_mb
| sort - estimated_mem_leak_mb

Wazuh OSSEC Rule

<group name="perl_http2_mem_exhaustion,">
    <rule id="100282" level="12">
        <if_sid>100280</if_sid>
        <field name="http2.stream_state">closed</field>
        <description>CVE-2026-16028: High volume of closed HTTP/2 streams observed from single source - possible memory exhaustion attack</description>
        <group>attack.t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Note: OSSEC rules typically operate on log lines from Wazuh agents. This requires the Wazuh agent to collect application logs that include HTTP/2 stream state events. Adjust the rule to match the actual log format of the deployed application.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The affected module is Protocol::HTTP2 versions before 1.14, but version 1.14 (or later) has not been confirmed as a fix. No vendor fix, workaround, or OSV advisory is available.

1) Immediate Mitigations (compensating controls):

• Connection lifecycle limits: Configure the web server/proxy layer to terminate HTTP/2 connections after a maximum number of completed requests (e.g., 10,000 streams per connection). This bounds the leak per connection but requires connection reuse; force keep-alive timeout reduction to encourage connection recycling.
• Memory monitoring: Deploy aggressive resident memory monitoring on processes using the module. Alert when process RSS exceeds 2× baseline; restart the process/service automatically on threshold breach.
• Rate limiting: Enforce per-client request rate limits at the reverse proxy or load balancer, though note that the attack is low-bandwidth (~19 B/stream) and may evade byte-oriented rate limits. Prefer connection/stream count limits.
• Disable HTTP/2: If feasible, disable HTTP/2 on affected endpoints and fall back to HTTP/1.1 until a patch is available. This removes the attack surface entirely.
• Front-end proxy: Terminate HTTP/2 at an unaffected front-end proxy (e.g., Nginx, HAProxy, Envoy) and forward to the Perl backend over HTTP/1.1.

2) Patch/Upgrade Steps:

• Monitor the Protocol::HTTP2 CPAN distribution for version 1.14 or later. Verify the changelog explicitly mentions removal of closed stream entries from the connection stream table.
• When a patched version is released, update via cpan -i Protocol::HTTP2 or your dependency manager. Re-run the module's test suite to confirm stream table entries are cleaned on stream closure.
• Re-test after upgrade: open 100,000 sequential streams on a single connection in a staging environment and confirm resident memory remains flat.

3) Long-Term Hardening:

• Input validation & resource governance: Implement per-connection request-count limits at the application layer, not just the proxy. This provides defense-in-depth should a similar vulnerability emerge in other HTTP/2 stack components.
• Dependency auditing: Add Protocol::HTTP2 to your software bill of materials (SBOM) and subscribe to CVE alerts for the CPAN distribution.
• Architecture review: Consider whether HTTP/2 termination should live in a dedicated, well-hardened component rather than application libraries. Memory-safety-focused implementations (Rust, Go) reduce the blast radius of such application-level leaks.
• Periodic re-evaluation: Re-check CISA KEV and vendor advisories weekly; this CVE is currently not listed in KEV, but status may change if in-the-wild exploitation emerges.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16028
2. CWE-401 Reference: https://cwe.mitre.org/data/definitions/401.html
3. Perl Protocol::HTTP2 CPAN Distribution: https://metacpan.org/dist/Protocol-HTTP2
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-16028 as of this report. The vulnerability is unpatched; organizations running the affected module should treat exposure as a credible denial-of-service risk and apply the mitigations above pending vendor fix availability.