GHSA-w8gf-g2vq-j2f4

Suggest an improvement
Source
https://github.com/advisories/GHSA-w8gf-g2vq-j2f4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-w8gf-g2vq-j2f4/GHSA-w8gf-g2vq-j2f4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w8gf-g2vq-j2f4
Related
Published
2024-04-03T18:49:42Z
Modified
2026-07-08T06:52:51Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames
Details

Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm.

Acknowledgements

Thank you to Bartek Nowotarski for reporting the vulnerability.

Database specific 
{
    "cwe_ids":  [
        "CWE-770",
        "CWE-789"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-03T18:49:42Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Packagist / amphp/http-client

Package

Name
amphp/http-client
Purl
pkg:composer/amphp/http-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0-rc10
Fixed
4.1.0-rc1

Affected versions

v4.*
v4.0.0-rc10
v4.0.0-rc11
v4.0.0

Database specific

last_known_affected_version_range 
"<= 4.0.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-w8gf-g2vq-j2f4/GHSA-w8gf-g2vq-j2f4.json"