GitHub Advisoryadvisory · Packagist

GHSA-w8gf-g2vq-j2f4 amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames

HIGH Published 2024-04-03 Modified 2024-04-03 Official page ↗
Ecosystem
Packagist
Packages
amphp/http-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-770, CWE-789
Reviewed
2024-04-03

Affected packages

• Packagist amphp/http-client: >= 4.0.0-rc10, < 4.1.0-rc1 → fixed in 4.1.0-rc1

Description

Early versions of `amphp/http-client` with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 `CONTINUATION` frames in an unbounded buffer and will not check the header size limit until it has received the `END_HEADERS` flag, resulting in an OOM crash. Later versions of `amphp/http-client` (v4.1.0-rc1 and up) depend on `amphp/http` for HTTP/2 processing and will therefore need an updated version of `amphp/http`, see GHSA-qjfw-cvjf-f4fm. Acknowledgements Thank you to Bartek Nowotarski for reporting the vulnerability.

Related

Weakness · CWE (2)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References