title: CVE-2024-2653
description: amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.
problem types: CWE-789: Memory Allocation with Excessive Size Value
affected:
{
vendor: AMPHP
product: amphp/http-client
versions:
status: affected, version: v4.0.0-rc10, lessThanOrEqual: 4.0.0, versionType: custom
}
{
vendor: AMPHP
product: amphp/http
versions:
status: affected, version: 2.0.0-beta.1, lessThanOrEqual: 2.1.0, versionType: custom
}
{
vendor: AMPHP
product: amphp/http
versions:
status: affected, version: v1.6.0-rc1, lessThanOrEqual: 1.7.2, versionType: custom
}
