Lucene search

OpenJS FoundationFRIENDSOFPHP:PHP:HTTP-CLIENT:CVE-2024-2653

HistoryJan 01, 1970 - 12:00 a.m.

Denial of Service via HTTP/2 CONTINUATION Frames

1970-01-0100:00:00

OpenJS Foundation

github.com

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Description Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm. Acknowledgements Thank you to Bartek Nowotarski for reporting the vulnerability.

Affected configurations

Vulners

Node

amphphttp-clientRange≤4.0.0

CPENameOperatorVersion
amphp/http-clientle4.0.0

CPE	Name	Operator	Version
	amphp/http-client	le	4.0.0