| Package | Affected versions | Patched versions |
|---|---|---|
| amphp/http | ≥ 2.0.0, < 2.1.1< 1.7.3 | 2.1.11.7.3 |
| amphp/http-client | ≥ 4.0.0-rc10, ≤ 4.0.0 |
amphp/http will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. amphp/http-client and amphp/http-server are indirectly affected if they're used with an unpatched version of amphp/http. Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) are also directly affected.
Thank you to Bartek Nowotarski for reporting the vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free