GHSA-x5mq-jjr3-vmx6 CVE-2025-24013
Missing validation of header name and value in codeigniter4/framework
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.51%
- Chance of exploitation in the next 30 days. Higher than 43.42% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-436 Interpretation Conflict
- Fix
4.5.8- Upgrade codeigniter4/framework to this version or later
Description
Impact
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.
Patches
Upgrade to v4.5.8 or later.
Workarounds
Validate HTTP header keys and/or values if using user-supplied values before passing them to Header class.
Differences from CVE-2023-29197
-
Affected Software:
- CVE-2023-29197 specifically addresses a vulnerability in the
guzzlehttp/psr7library. - The reported issue in this Security Advisory is within the CodeIgniter4 framework and does not depend on or use the
guzzlehttp/psr7library.
- CVE-2023-29197 specifically addresses a vulnerability in the
-
Root Cause and Implementation:
- The vulnerability reported arises from an issue in the Header class of CodeIgniter4, which is unrelated to the functionality or implementation of
guzzlehttp/psr7.
- The vulnerability reported arises from an issue in the Header class of CodeIgniter4, which is unrelated to the functionality or implementation of
-
Scope of Impact:
- The vulnerability described in this Security Advisory affects applications built with the CodeIgniter4 framework, which does not use or rely on the
guzzlehttp/psr7library.
- The vulnerability described in this Security Advisory affects applications built with the CodeIgniter4 framework, which does not use or rely on the
References
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| codeigniter4/framework | < 4.5.8 |
4.5.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
codeigniter4/framework Packagist → 4.5.8
- composer
composer require codeigniter4/framework:^4.5.8
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5x38-2vff-x55p Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 | High | Same weakness, CWE-436 |
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes | Medium | Same weakness, CWE-436 |
| GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass | Medium | Same weakness, CWE-436 |
| GHSA-m665-v7pm-7grj zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | Critical | Same weakness, CWE-436 |
| EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | Not rated yet | Same weakness, CWE-436 |
| GHSA-8c8m-p3m8-cjg8 Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient | Medium | Same weakness, CWE-436 |
| GHSA-m943-m63m-w62w Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient | Medium | Same weakness, CWE-436 |
| GHSA-85x2-q946-cp5h Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name | Medium | Same weakness, CWE-436 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor