CVE-2024-2757

In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/04/12/11	Mailing List
https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq	Exploit Vendor Advisory
https://security.netapp.com/advisory/ntap-20240510-0011/	Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/12/11	Mailing List
https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq	Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/
https://security.netapp.com/advisory/ntap-20240510-0011/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

History

04 Nov 2025, 18:16

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/[email protected]/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/ -

Information

Published : 2024-04-29 04:15

Updated : 2025-11-04 18:16

NVD link : CVE-2024-2757

Mitre link : CVE-2024-2757

CVE.ORG link : CVE-2024-2757

JSON object : View

Products Affected

php

php

CWE

NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2024-2757", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-04-29T04:15:08.113", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/04/12/11", "tags": ["Mailing List"], "source": "[email protected]"}, {"url": "https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://security.netapp.com/advisory/ntap-20240510-0011/", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/12/11", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240510-0011/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "In PHP 8.3.* before 8.3.5, function\u00a0mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function."}, {"lang": "es", "value": "En PHP 8.3.* anterior a 8.3.5, la funci\u00f3n mb_encode_mimeheader() se ejecuta sin cesar para algunas entradas que contienen cadenas largas de caracteres que no son espacios seguidos de un espacio. Esto podr\u00eda provocar un posible ataque DoS si un usuario hostil env\u00eda datos a una aplicaci\u00f3n que utiliza esta funci\u00f3n."}], "lastModified": "2025-11-04T18:16:18.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE619987-797E-493B-B089-2E1CADDA9C47", "versionEndExcluding": "8.3.5", "versionStartIncluding": "8.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}