GHSA-w8gf-g2vq-j2f4
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames
Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm.
Acknowledgements
Thank you to Bartek Nowotarski for reporting the vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
What each source reports
GitHub Advisories Score used
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames
Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm.
Acknowledgements
Thank you to Bartek Nowotarski for reporting the vulnerability.
- Record
GHSA-w8gf-g2vq-j2f4- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-770, CWE-789
- Updated
- 2026-11-02
OSV
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames
Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client (v4.1.0-rc1 and up) depend on amphp/http for HTTP/2 processing and will therefore need an updated version of amphp/http, see GHSA-qjfw-cvjf-f4fm.
Acknowledgements
Thank you to Bartek Nowotarski for reporting the vulnerability.
- Record
GHSA-w8gf-g2vq-j2f4- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-770, CWE-789
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
amphp/http-clientPackagist | 4.0.0-rc10 to 4.0.0 | 4.1.0-rc1 |
amphp/http-clientPackagist | 4.0.0-rc10 up to 4.1.0-rc1, plus listed versions v4.0.0v4.0.0-rc10v4.0.0-rc11 | 4.1.0-rc1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-w8gf-g2vq-j2f4 is a high vulnerability (CVSS 8.2) in amphp/http-client, published April 3, 2024. No source lists public exploit code. Fixed in amphp/http-client 4.1.0-rc1.