| Name | CVE-2024-2653 |
| Description | amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1011274, 1011337 |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| php-amphp-http | ITP | 1011337 | ||||
| php-amphp-http-client | ITP | 1011274 |
https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm
https://github.com/amphp/http-client/security/advisories/GHSA-w8gf-g2vq-j2f4