Most recent entries from all

bdu:2024-02654

EUVD-2026-259435

fkie_cve-2024-2653

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.

GHSA-qjfw-cvjf-f4fm — AMPHP Denial of Service via HTTP/2 CONTINUATION Frames

Affected: Packagist: amphp/http, Packagist: amphp/http-client

`amphp/http` will collect HTTP/2 `CONTINUATION` frames in an unbounded buffer and will not check the header size limit until it has received the `END_HEADERS` flag, resulting in an OOM crash. `amphp/http-client` and `amphp/http-server` are indirectly affected if they're used with an unpatched version of `amphp/http`. Early versions of `amphp/http-client` with HTTP/2 support (v4.0.0-rc10 to 4.0.0) are also directly affected.

## Acknowledgements

Thank you to [Bartek Nowotarski](https://nowotarski.info/) for reporting the vulnerability.

gsd-2024-2653

WID-SEC-W-2024-0789 — HTTP/2: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstellen in verschiedenen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.