amphp/http-client · Security
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames
- GHSA ID
- GHSA-w8gf-g2vq-j2f4
- Severity
- high
- Published
- Updated
- CVSS
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- CVSS v3
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Description
Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm.
Acknowledgements
Thank you to Bartek Nowotarski for reporting the vulnerability.
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling
- CWE-789 · Memory Allocation with Excessive Size Value