CVE-2024-2757

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2757
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/12/11
https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq
https://security.netapp.com/advisory/ntap-20240510-0011/
http://www.openwall.com/lists/oss-security/2024/04/12/11
https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq
https://security.netapp.com/advisory/ntap-20240510-0011/
Configurations

No configuration.

History

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.  (en) In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
Information

Published : 2024-04-29 04:15

Updated : 2025-02-13 18:17

NVD link : CVE-2024-2757

Mitre link : CVE-2024-2757

CVE.ORG link : CVE-2024-2757

JSON object : View

Products Affected

No product.

CWE
CWE-400

Uncontrolled Resource Consumption