Endless Loop in mb_encode_mimeheader Function Could Lead to DoS Attack

CVE-2024-2757

Summary

In PHP versions 8.3.0 through 8.3.4, an issue has been identified within the mb_encode_mimeheader function, where certain inputs consisting of lengthy sequences of non-space characters followed by a space can cause the function to enter an infinite loop. This behavior can potentially be exploited by malicious users, allowing for a Denial of Service (DoS) attack against applications relying on this function. It is crucial for users to update to PHP 8.3.5 or later to mitigate this risk and ensure the stability and security of their applications.

References