Medium severity4.8NVD Advisory· Published Feb 1, 2024· Updated Jun 17, 2026
CVE-2024-24753
CVE-2024-24753
Description
Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
bref/brefPackagist | < 2.1.13 | 2.1.13 |
Affected products
3- brefphp/brefv5Range: < 2.1.13
Patches
Vulnerability mechanics
References
5- github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dcnvdPatchWEB
- github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9rnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-99f9-gv72-fw9rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-24753ghsaADVISORY
- github.com/brefphp/bref/blob/2.1.12/src/Event/Http/HttpResponse.phpghsaWEB
News mentions
0No linked articles in our index yet.