{"uuid": "0e0c0d5f-7296-43cd-9276-7f7fb1e2d164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-g7m4-839x-ch6v", "type": "seen", "source": "https://gist.github.com/alon710/9444ec80b5b6b03e92361b8cc9ab95ef", "content": "# GHSA-G7M4-839X-CH6V: GHSA-g7m4-839x-ch6v: Denial of Service via Unbounded Digits Parameter in spomky-labs/otphp\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-06-18\n> **Full Report:** https://cvereports.com/reports/GHSA-G7M4-839X-CH6V\n\n## Summary\nThe spomky-labs/otphp library prior to version 11.4.3 is vulnerable to an unhandled DivisionByZeroError crash when parsing provisioning URIs containing a digits parameter value equal to or greater than 40. This allows unauthenticated remote attackers to trigger a Denial of Service by supplying a crafted URI, which causes float-to-integer cast overflow and subsequent division-by-zero fatal error in modern PHP runtimes.\n\n## TL;DR\nUnbounded digits parameter in otphp provisioning URIs triggers a float-to-integer conversion overflow, culminating in an unhandled division-by-zero fatal crash in PHP.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1284 / CWE-369\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7\n- **EPSS Score**: Not Mapped (No CVE)\n- **Impact**: Denial of Service (Availability: High)\n- **Exploit Status**: Proof-of-Concept (PoC) Released\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- spomky-labs/otphp\n- **spomky-labs/otphp**: < 11.4.3 (Fixed in: `11.4.3`)\n\n## Mitigation\n\n- Upgrade spomky-labs/otphp to 11.4.3 or higher\n- Pre-parse and validate digits parameters before calling loadFromProvisioningUri\n- Catch global Throwable instead of Exception to gracefully handle DivisionByZeroError in PHP 8.x\n\n**Remediation Steps:**\n1. Modify composer.json to require \"spomky-labs/otphp\": \"^11.4.3\"\n2. Execute composer update spomky-labs/otphp to perform the vendor updates\n3. Implement custom pre-parsing middleware to validate digits query parameter inside standard range (4 to 10)\n4. Refactor try/catch blocks encapsulating OTP generation to target the base \\Throwable interface\n\n## References\n\n- [Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation](https://github.com/Spomky-Labs/otphp/security/advisories/GHSA-g7m4-839x-ch6v)\n- [GitHub Advisory Database Record for GHSA-g7m4-839x-ch6v](https://github.com/advisories/GHSA-g7m4-839x-ch6v)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-G7M4-839X-CH6V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-19T03:11:39.000000Z"}