CVE-2024-24753

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-436

Affected software

No affected versions have been published.

Timeline

Published: Feb 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247549.8Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInter CVE-2024-247555.3discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-CVE-2024-247567.5Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be re CVE-2024-247579.8open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when worki CVE-2024-247584.5Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but CVE-2024-247599.1MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the s CVE-2024-24764.3The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane CVE-2024-247607.3mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified CVE-2024-247617.5Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, publi CVE-2024-247627.5`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse t CVE-2024-247636.1JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exp CVE-2024-247644.8October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirec