CVE-2024-2653

CVE-2024-2653 is a high-severity vulnerability with a CVSS 3.x base score of 8.2. Its EPSS exploit-prediction score of 83% places it in the 100th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.

Frequently asked questions

What is CVE-2024-2653?
amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash.
How severe is CVE-2024-2653?
CVE-2024-2653 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.
Is CVE-2024-2653 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 83% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-2653?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-2653 have an EU (EUVD) identifier?
Yes. CVE-2024-2653 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-1280.
When was CVE-2024-2653 published?
CVE-2024-2653 was published on 2024-04-03 and last updated on 2026-06-17.

References