CVE-2024-2757

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2757
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/12/11 Mailing List
https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq Exploit Vendor Advisory
https://security.netapp.com/advisory/ntap-20240510-0011/ Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/12/11 Mailing List
https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq Exploit Vendor Advisory
https://security.netapp.com/advisory/ntap-20240510-0011/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
History

18 Jun 2025, 21:11

Type Values Removed Values Added
CPE cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Php php
Php
References () http://www.openwall.com/lists/oss-security/2024/04/12/11 - () http://www.openwall.com/lists/oss-security/2024/04/12/11 - Mailing List
References () https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq - () https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq - Exploit, Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20240510-0011/ - () https://security.netapp.com/advisory/ntap-20240510-0011/ - Third Party Advisory

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.  (en) In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

21 Nov 2024, 09:10

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/04/12/11 - () http://www.openwall.com/lists/oss-security/2024/04/12/11 -
References () https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq - () https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq -
References () https://security.netapp.com/advisory/ntap-20240510-0011/ - () https://security.netapp.com/advisory/ntap-20240510-0011/ -

03 Jul 2024, 01:53

Type Values Removed Values Added
CWE CWE-400

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240510-0011/ -

01 May 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/12/11 -
Summary
  • (es) En PHP 8.3.* anterior a 8.3.5, la función mb_encode_mimeheader() se ejecuta sin cesar para algunas entradas que contienen cadenas largas de caracteres que no son espacios seguidos de un espacio. Esto podría provocar un posible ataque DoS si un usuario hostil envía datos a una aplicación que utiliza esta función.

29 Apr 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-29 04:15

Updated : 2025-06-18 21:11

NVD link : CVE-2024-2757

Mitre link : CVE-2024-2757

CVE.ORG link : CVE-2024-2757

JSON object : View

Products Affected

php

  • php
CWE
NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption