Summary
The request body parsing in PHP allows any unauthenticated attacker to consume
a large amount of CPU time and trigger excessive logging.
Details
The multipart body parser processes an unlimited number of file parts.
The multipart body parser processes an unlimited number of field parts.
The multipart body parser emits an unbound number of warning messages.
Impact
This is a remote unauthenticated Denial of Service vulnerability.
The default/production configuration is affected by this vulnerability.
The large amount of CPU time required for processing requests can block all
available worker processes and significantly delay or slow down the processing
of legitimate user requests.
The large volume of warning messages can wear down the disk and fill it up.
Complete DoS is achievable by sending many concurrent multipart requests in a
loop.
PHP parses the request body before invoking any application scripts.
This vulnerability affects all PHP websites that accept POST request bodies
(post_max_size set to a value greater than zero, the default value is 8MB).
As a mitigation, users can decrease post_max_size close to zero. This will
render most websites non-interactive and/or break file uploads.
das7pad Reporter
Summary
The request body parsing in PHP allows any unauthenticated attacker to consume
a large amount of CPU time and trigger excessive logging.
Details
The multipart body parser processes an unlimited number of file parts.
The multipart body parser processes an unlimited number of field parts.
The multipart body parser emits an unbound number of warning messages.
Impact
This is a remote unauthenticated Denial of Service vulnerability.
The default/production configuration is affected by this vulnerability.
The large amount of CPU time required for processing requests can block all
available worker processes and significantly delay or slow down the processing
of legitimate user requests.
The large volume of warning messages can wear down the disk and fill it up.
Complete DoS is achievable by sending many concurrent multipart requests in a
loop.
PHP parses the request body before invoking any application scripts.
This vulnerability affects all PHP websites that accept POST request bodies
(
post_max_sizeset to a value greater than zero, the default value is 8MB).As a mitigation, users can decrease
post_max_sizeclose to zero. This willrender most websites non-interactive and/or break file uploads.