← Back to browse · API

CVE-2024-2653

Severity
HIGH
CVSS
8.2
EPSS
0.83244
Risk score
61.94
CISA KEV
No
PoC
No
Published
2024-04-03
Modified
2025-11-04
First seen
2026-08-07
Aliases
EUVD-2024-1280, GHSA-QJFW-CVJF-F4FM
Products
AMPHP:amphp/http 2.0.0-beta.1 ≤2.1.0, AMPHP:amphp/http v1.6.0-rc1 ≤1.7.2, AMPHP:amphp/http-client v4.0.0-rc10 ≤4.0.0
Sources
euvd EUVD-2024-1280

Description

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.

References