CVEs-PoC/2024/CVE-2024-2653.md

CVE-2024-2653

Description

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.

POC

Reference

No PoCs from references.

Github

• https://github.com/Ampferl/poc_http2-continuation-flood
• https://github.com/DrewskyDev/H2Flood
• https://github.com/Vos68/HTTP2-Continuation-Flood-PoC
• https://github.com/lockness-Ko/CVE-2024-27316