CVE-2024-2757

An infinite loop vulnerability was found in PHP. Certain inputs provided to mb_encode_mimeheader trigger an endless loop.

Red Hat Enterprise Linux remains unaffected by this vulnerability since it does not include the vulnerable codebase or version. This CVE only affects PHP 8.3 that we did not ship.

The vulnerability in mb_encode_mimeheader presents a moderate severity issue due to its potential for causing service disruption and resource exhaustion. While the vulnerability primarily manifests as an infinite loop with specific input strings, it requires the function to be invoked with the problematic input. This limits its immediate impact to systems where the function is explicitly called with unfiltered or untrusted inputs. Moreover, its exploitation primarily leads to a Denial-of-Service (DoS) condition rather than arbitrary code execution or data compromise. However, given the function's integral role in email processing and its use in frameworks like CakePHP 5, the risk of disruption to email services and associated processing routines is non-trivial.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.