CVE-2024-2653 is a high-severity denial-of-service vulnerability affecting amphp/http, where an unbounded buffer for CONTINUATION frames can lead to an out-of-memory crash. This vulnerability has a CVSS score of 8.2, indicating a critical impact with high availability loss. While there is no known active exploitation or publicly available exploit code, the vulnerability has garnered significant community attention and media coverage, including reports of a new HTTP/2 DoS attack.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| AMPHP | Amphp/Http | >= v1.6.0-rc1, <= 1.7.2CNA affected | |
| AMPHP | Amphp/Http | >= 2.0.0-beta.1, <= 2.1.0CNA affected | |
| AMPHP | Amphp/Http-Client | >= v4.0.0-rc10, <= 4.0.0CNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.