AMPHP Denial of Service via HTTP/2 CONTINUATION FramesGHSA-qjfw-cvjf-f4fm
HIGHFix: amphp/http@3a33e68GHSA-qjfw-cvjf-f4fm is a high-severity (CVSS 8.2) vulnerability in amphp/http. EPSS puts its 30-day exploitation probability at 80.3% (100th percentile). A fix is available for amphp/http — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-qjfw-cvjf-f4fm.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
amphp/http🐘amphp/http🐘amphp/http-clientReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
amphp/http will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the END_HEADERS flag, resulting in an OOM crash. amphp/http-client and amphp/http-server are indirectly affected if they're used with an unpatched version of amphp/http. Early versions of amphp/http-client with HTTP/2 support (v4.0.0-rc10 to 4.0.0) are also directly affected.
Acknowledgements
Thank you to Bartek Nowotarski for reporting the vulnerability.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | amphp/http | ≥ 2.0.0&&< 2.1.1 | 2.1.1composer require amphp/http:^2.1.1 |
| 🐘Packagist | amphp/http | all versions | 1.7.3composer require amphp/http:^1.7.3 |
| 🐘Packagist | amphp/http-client | ≥ 4.0.0-rc10 | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for amphp/http, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update amphp/http to 2.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qjfw-cvjf-f4fm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is no reasonable mitigation. Once an attack has ended, the system should return to normal operations on its…
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.Source: Red Hat security advisory for GHSA-qjfw-cvjf-f4fm (CC BY 4.0)
Frequently Asked Questions
Is GHSA-qjfw-cvjf-f4fm in your dependencies?
Find it across Packagist, including transitive dependencies.