Description
amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AMPHP | amphp/http-client | v4.0.0-rc10 – ≤ 4.0.0 | — |
| AMPHP | amphp/http | 2.0.0-beta.1 – ≤ 2.1.0, v1.6.0-rc1 – ≤ 1.7.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | amphp/http | >= 2.0.0, < 2.1.1 | 2.1.1 | GHSA-qjfw-cvjf-f4fm |
| Packagist | amphp/http | < 1.7.3 | 1.7.3 | GHSA-qjfw-cvjf-f4fm |
| Packagist | amphp/http-client | >= 4.0.0-rc10, <= 4.0.0 | — | GHSA-qjfw-cvjf-f4fm |
Advisories 1
- WID-SEC-2024-0789 HTTP/2: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Oct 15, 2026