AMPHP Denial of Service via HTTP/2 CONTINUATION Frames

HIGH 8.2CVE-2024-2653 · GHSA-qjfw-cvjf-f4fm · Published 03/04/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
amphp/http Packagist	`≥ 2.0.0, < 2.1.1< 1.7.3`	`2.1.11.7.3`
amphp/http-client Packagist	`≥ 4.0.0-rc10, ≤ 4.0.0`	No fix yet

Description

amphp/http will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. amphp/http-client and amphp/http-server are indirectly affected if they're used with an unpatched version of amphp/http. Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) are also directly affected.

Acknowledgements

Thank you to Bartek Nowotarski for reporting the vulnerability.

NVD description

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.

References

amphp/http-client security advisory · WEB
amphp/http security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-2653 · ADVISORY
amphp/http commit 3a33e68 · WEB
amphp/http commit 881cc33 · WEB
FriendsOfPHP/security-advisories · WEB
FriendsOfPHP/security-advisories · WEB
amphp/http · PACKAGE
kb.cert.org/vuls/id/421644 · WEB
openwall.com/lists/oss-security/2024/04/03/16 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free