CVE-2024-2653: AMPHP Denial of Service via HTTP/2 CONTINUATION Frames

April 3, 2024

amphp/http will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. amphp/http-client and amphp/http-server are indirectly affected if they’re used with an unpatched version of amphp/http. Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) are also directly affected.

References

github.com/advisories/GHSA-qjfw-cvjf-f4fm
github.com/amphp/http
github.com/amphp/http/commit/3a33e68a3b53f7279217238e89748cf0cb30b8a6
github.com/amphp/http/commit/881cc33da236fbcd0cb0cf6c2bfc7efcf80ede76
github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm
nvd.nist.gov/vuln/detail/CVE-2024-2653

Code Behaviors & Features

Detect and mitigate CVE-2024-2653 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →