All vulnerabilities

Servers and applications

CVE-2024-2757

In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

Severity
High 7.5
Published
29 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.3.5
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.3.0 before 8.3.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-2757
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-2757