CVE-2024-2757

Published: Apr 29, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security@php.net (Secondary)

Description

In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

Affected (1)

Products: Php: Php

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 8.3.0 to 8.3.5

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (7)

http://www.openwall.com/lists/oss-security/2024/04/12/11

Source: security@php.net

Mailing List

https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq

Source: security@php.net

ExploitVendor Advisory

https://security.netapp.com/advisory/ntap-20240510-0011/

Source: security@php.net

Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/04/12/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20240510-0011/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.