Description
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PHP Group PHP
Default version status: unaffected
8.3.* to < 8.3.5affected
References
- https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq ↗
- http://www.openwall.com/lists/oss-security/2024/04/12/11 ↗
- https://security.netapp.com/advisory/ntap-20240510-0011/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/ ↗