amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames

HIGH 8.2GHSA-w8gf-g2vq-j2f4 · Published 03/04/2024 · updated 08/07/2026

In short

GHSA-w8gf-g2vq-j2f4 is a HIGH (CVSS 8.2) vulnerability affecting amphp/http-client.
Fix: update to 4.1.0-rc1 or later.

Package	Affected versions	Patched versions
amphp/http-client Packagist	`≥ 4.0.0-rc10, < 4.1.0-rc1`	`4.1.0-rc1`

Description

Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm.

Acknowledgements

Thank you to Bartek Nowotarski for reporting the vulnerability.

References

amphp/http-client security advisory · WEB
amphp/http security advisory · WEB
amphp/http-client · PACKAGE

More vulnerabilities in amphp/http-client

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free