CVE-2025-24013
published 2025-01-20CVE-2025-24013: CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.48%
37.6th percentile
CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codeigniter | codeigniter | < 4.5.8 | 4.5.8 |
| codeigniter4 | codeigniter4 | < 4.5.8 | 4.5.8 |
| codeigniter4 | framework | >= 0 < 4.5.8 | 4.5.8 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ghsa7.5HIGH
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing validation of header name and value in codeigniter4/framework
ghsa·2025-01-21·CVSS 7.5
CVE-2025-24013 [HIGH] CWE-436 Missing validation of header name and value in codeigniter4/framework
Missing validation of header name and value in codeigniter4/framework
### Impact
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.
### Patches
Upgrade to v4.5.8 or later.
### Workarounds
Validate HTTP header keys and/or values if using user-supplied values before passing them to `Header` class.
### Differences from CVE-2023-29197
1. **Affected Software**:
* CVE-2023-29197 specifically a
OSV
Missing validation of header name and value in codeigniter4/framework
osv·2025-01-21·CVSS 7.5
CVE-2025-24013 [HIGH] Missing validation of header name and value in codeigniter4/framework
Missing validation of header name and value in codeigniter4/framework
### Impact
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.
### Patches
Upgrade to v4.5.8 or later.
### Workarounds
Validate HTTP header keys and/or values if using user-supplied values before passing them to `Header` class.
### Differences from CVE-2023-29197
1. **Affected Software**:
* CVE-2023-29197 specifically a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-01-20
Published