CVE-2024-2653

The amphp/http library and the amphp/http-client HTTP client (versions 4.0.0-rc10 to 4.0.0 ) are vulnerable to a Denial of Service (DoS) attack due to improper handling of the HTTP/2 protocol. Specifically, the software collects CONTINUATION frames in an unbounded buffer without checking limits u...

CVE-2024-2653

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set ENDHEADERS flag, resulting in an OOM crash...

CVE-2024-2653 CVE-2024-2653

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set ENDHEADERS flag, resulting in an OOM crash...

CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758

The Tempesta FW web application firewall is vulnerable to a denial-of-service (DoS) attack due to the HTTP/2 CONTINUATION Flood vulnerability. The root cause is the incorrect handling of CONTINUATION frames in the HTTP/2 protocol, where an attacker can send a continuous stream of frames without t...

CVE-2024-2758 CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

DEBIAN-CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26693 wifi: iwlwifi: mvm: fix a crash when we run out of stations

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26693 wifi: iwlwifi: mvm: fix a crash when we run out of stations

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

CVE-2024-26693

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a crash when we run out of stations A DoS tool that injects loads of authentication frames made our AP crash. The iwlmvmisdup function couldn't find the per-queue dupdata which was not allocated. The root...

PT-2024-40495 · Unknown · Amphp/Http +1

Name of the Vulnerable Software and Affected Versions: amphp/http-client versions 4.0.0-rc10 through 4.0.0 Description: The issue affects early versions of amphp/http-client with HTTP/2 support, causing the collection of HTTP/2 CONTINUATION frames in an unbounded buffer. This occurs because the...

amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames

Early versions of amphp/http-client with HTTP/2 support v4.0.0-rc10 to 4.0.0 will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the ENDHEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client v4.1.0-rc1...

go -- http2: close connections when receiving too many headers

The Go project reports: http2: close connections when receiving too many headers Maintaining HPACK state requires that we parse and process all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, we don't allocate memory to store the excess headers but...

PT-2024-21470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A DoS tool that injects loads of authentication frames can cause the AP to crash. The iwl mvm is dup function couldn't find the per-queue dup data which was not allocated. The root cause...

CVE-2024-2758: Undefined Security Weakness

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2653: Undefined Security Weakness

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set ENDHEADERS flag, resulting in an OOM crash...

AMPHP Denial of Service via HTTP/2 CONTINUATION Frames

amphp/http will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the ENDHEADERS flag, resulting in an OOM crash. amphp/http-client and amphp/http-server are indirectly affected if they're used with an unpatched version of...

Security Advisory 0094

Security Advisory 0094 PDF Date: April 5, 2024 Revision | Date | Changes ---|---|--- 1.0 | April 3, 2024 | Initial release 1.1 | April 5, 2024 | Update required configuration for exploitation and mitigation Description Arista Networks is providing this security update in response to the following...