Interpretation Conflict Affecting codeigniter4/framework package, versions <4.5.8
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-CODEIGNITER4FRAMEWORK-8651763
- published22 Jan 2025
- disclosed21 Jan 2025
- creditneznaika0
Introduced: 21 Jan 2025
NewCVE-2025-24013 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade codeigniter4/framework to version 4.5.8 or higher.
Overview
codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure.
Affected versions of this package are vulnerable to Interpretation Conflict due to a lack of validations of the header name and value.
Workaround
Users who are unable to upgrade to the fixed version are advised to validate HTTP header keys and/or values if using user-supplied values before passing them to Header class.