CVE-2024-2757: PHP mb_encode_mimeheader runs endlessly for some inputs
Fixed bug GHSA-fjp9-9hwx-59fq (mbencodemimeheader runs endlessly for some inputs). (CVE-2024-2757)
Other sources
In PHP 8.3. before 8.3.5, function mbencodemimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
— MITRE
PHP mbencodemimeheader runs endlessly for some inputs
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.5Patch GHSA-fjp9-9hwx-59fq
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2757?
CVE-2024-2757 has been classified as a moderate severity vulnerability due to its potential to cause an infinite loop in the mb_encode_mimeheader function.
How do I fix CVE-2024-2757?
To fix CVE-2024-2757, upgrade PHP to version 8.3.6 or later.
What versions of PHP are affected by CVE-2024-2757?
CVE-2024-2757 affects PHP versions prior to 8.3.5.
What is the bug in CVE-2024-2757 about?
The bug in CVE-2024-2757 causes the mb_encode_mimeheader function to run endlessly when it encounters certain long strings.
Is there a workaround for CVE-2024-2757 before upgrading?
Currently, it is recommended to avoid using inputs that have long strings of non-space characters followed by a space as a temporary workaround for CVE-2024-2757.