CVE-2024-2757 PHP mb_encode_mimeheader runs endlessly for some inputs
Attackers can cause a denial of service by sending specific inputs to applications using the mb_encode_mimeheader function in PHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2757?
CVE-2024-2757 is a high-severity denial of service vulnerability in Php Php, published on 29 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
Weakness: CWE-400
Which versions are affected by CVE-2024-2757?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.3.0 | 8.3.5 |
php Bitnami | From 8.3.0 | 8.3.5 |
php-min Bitnami | From 8.3.0 | 8.3.5 |
Products include Php Php.
How do I fix CVE-2024-2757?
Upgrade libphp to 8.3.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-2757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2757 exists.
Other vulnerabilities in Php Php
Sources
Also known as AZL-40055, BELL-CVE-2024-2757, BIT-libphp-2024-2757, BIT-php-2024-2757, BIT-php-min-2024-2757, CLEANSTART-2026-AE99282 and 2 more.