Remote DoS via overflowed Content-Length

[dapickle]

Description

Summary

An integer overflow vulnerability in PHP's built-in web server CLI SAPI allows remote attackers to trigger a DoS by sending a malicious HTTP request with an overflowed Content-Length header value. The vulnerability exists in the HTTP parser that processes Content-Length headers without proper overflow checks.

Details

The vulnerability is located in sapi/cli/php_http_parser.c:

case h_content_length:
  if (ch == ' ') break;
  if (ch < '0' || ch > '9') goto error;
  parser->content_length *= 10;  // <-- NO OVERFLOW CHECK
  parser->content_length += ch - '0';  // <-- NO OVERFLOW CHECK
  break;

The parser accumulates the Content-Length value digit by digit without checking for integer overflow. When an attacker sends a Content-Length header with a very large value (e.g., 50+ digits), the value wraps around due to integer overflow.

Affected Component: PHP CLI built-in web server (php -S)
Affected Versions: All versions with CLI server (PHP 5.4+)
Attack Vector: Network (remote)
Authentication: None required

PoC

1. Start PHP built-in server:

   php -S localhost:8891 -t /

2. Manually with curl (limited by curl's header validation):

   curl -X POST -H "Content-Length: 999999999999999999999999999999" \
        -d "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
        http://localhost:8891/

Expected Behavior:

• Server may crash due to OOM crash or process abort due to oversized memory allocation
• Server may hang or become unresponsive

Impact

This vulnerability affects any webs using PHP application running on the built-in CLI web server.

• Development environments
• Testing and staging servers
• Docker containers and microservices

Who is impacted:

• Developers using php -S for local development
• Applications deployed with PHP built-in server in production
• Any service exposing PHP CLI server to untrusted networks

Potential Impact:

• Denial of Service (crash or hang)

PHP Version

**Affected Versions:** All versions with CLI server (PHP 5.4+)

Operating System

No response

[licaonkter]

php should read php.ini, and enforce the rule of max POST size; it should return 400 when max-post-size defined in php.ini < Content-Length

[LamentXU123]

I successfully reproduce this in my ubuntu with debug message.

[DanielEScherzer]

https://www.php.net/manual/en/features.commandline.webserver.php

Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network.

So the "Attack Vector: Network (remote)" part of the report is a bit misleading, if you have exposed php -S to the network despite explicit documentation not to do so

[dapickle]

I know I read the warning, it is perfect, but technically this issue can be remotly triggerable.

[iliaal]

Not a security issue for the reasons mentioned above, but worth fixing, PR in-bound