CVE-2024-24753 - CVE House
Back to Database
Status published Medium CVE-2024-24753

Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

Vulnerability Description

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24753

Credits & Attribution

No credits recorded in the NVD database.

References

More from brefphp

View All →
CVE-2024-29186
Slow String Operations via MultiPart Requests in Event-Driven Functions
Medium 5.3
CVE-2024-24754
Bref Body Parsing Inconsistency in Event-Driven Functions
Low 3.7
CVE-2024-24752
Bref Uploaded Files Not Deleted in Event-Driven Functions
Medium 6.5

Affected Vendor

Affected Software

bref
Vulnerable Versions:
< 2.1.13

Timeline

Official Publish: February 1st, 2024
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-436

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.