Resource exhaustion in PHP - CVE-2024-2757
Published: April 11, 2024
Vulnerability identifier: #VU88485
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-2757
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the mb_encode_mimeheader() function can run endlessly for certain inputs A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Affected software
PHP
Gentoo Linux
Fedora
Oracle Solaris
Storage Sentinel Anomaly Scan Engine
php
Gentoo Linux
Fedora
Oracle Solaris
Storage Sentinel Anomaly Scan Engine
php
How to mitigate CVE-2024-2757
Install updates from vendor's website.
PHP - update to 8.3.6
php - update to 8.3.5-1.fc40
Oracle Solaris - update to 11.4 SRU 71
php - update to 8.3.5-1.fc40
Oracle Solaris - update to 11.4 SRU 71