GHSA-qjfw-cvjf-f4fm AMPHP Denial of Service via HTTP/2 CONTINUATION Frames

• Packagist amphp/http: >= 2.0.0, < 2.1.1 → fixed in 2.1.1 • Packagist amphp/http: < 1.7.3 → fixed in 1.7.3 • Packagist amphp/http-client: >= 4.0.0-rc10, <= 4.0.0 (no fix yet)

`amphp/http` will collect HTTP/2 `CONTINUATION` frames in an unbounded buffer and will not check the header size limit until it has received the `END_HEADERS` flag, resulting in an OOM crash. `amphp/http-client` and `amphp/http-server` are indirectly affected if they're used with an unpatched version of `amphp/http`. Early versions of `amphp/http-client` with HTTP/2 support (v4.0.0-rc10 to 4.0.0) are also directly affected. Acknowledgements Thank you to Bartek Nowotarski for reporting the vulnerability.