GHSA-w8gf-g2vq-j2f4: 
PHP vulnerability analysis and mitigation

The vulnerability (CVE-2024-2653) affects amphp/http and amphp/http-client packages, discovered and disclosed on April 3, 2024. The issue impacts versions 4.0.0-rc10 to 4.0.0 of amphp/http-client and versions up to 2.1.0 of amphp/http. This vulnerability relates to the handling of HTTP/2 CONTINUATION frames in the HTTP protocol implementation (GitHub Advisory, CERT VU).

The vulnerability occurs when the implementation collects HTTP/2 CONTINUATION frames in an unbounded buffer without checking the header size limit until receiving the END_HEADERS flag. The issue has been assigned a CVSS v3.1 base score of 8.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, indicating it can be exploited remotely with low complexity and requires no privileges or user interaction (GitHub Advisory).

The vulnerability can result in an Out of Memory (OOM) crash when exploited. The CVSS metrics indicate high impact on availability (A:H) and low impact on integrity (I:L), with no impact on confidentiality (C:N). This can lead to denial of service conditions in affected systems (GitHub Advisory, CERT VU).

The vulnerability is highly exploitable due to its network attack vector (AV:N) and low attack complexity (AC:L). An attacker can trigger the vulnerability by sending a stream of CONTINUATION frames without the END_HEADERS flag set, leading to unbounded buffer growth (CERT VU).

The vulnerability has been patched in amphp/http-client version 4.1.0-rc1 and amphp/http versions 2.1.1 and 1.7.3. Users are advised to upgrade to these patched versions. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and require an updated version of amphp/http (GitHub Advisory).