{"id":"CVE-2025-24013","aliases":["GHSA-x5mq-jjr3-vmx6"],"url":"https://o3.security/vulnerability/CVE-2025-24013","summary":"CodeIgniter validation of header name and value","details":"### Impact\nLack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.\n\n### Patches\nUpgrade to v4.5.8 or later.\n\n### Workarounds\nValidate HTTP header keys and/or values if using user-supplied values before passing them to `Header` class.\n\n### Differences from CVE-2023-29197\n\n1. **Affected Software**:\n    * CVE-2023-29197 specifically addresses a vulnerability in the `guzzlehttp/psr7` library.\n    * The reported issue in this Security Advisory is within the **CodeIgniter4** framework and does not depend on or use the `guzzlehttp/psr7` library.\n\n2. **Root Cause and Implementation**:\n    * The vulnerability reported arises from an issue in the **Header class** of CodeIgniter4, which is unrelated to the functionality or implementation of `guzzlehttp/psr7`.\n\n3. **Scope of Impact**:\n    * The vulnerability described in this Security Advisory affects applications built with the **CodeIgniter4** framework, which does not use or rely on the `guzzlehttp/psr7` library.\n\n### References\n* https://datatracker.ietf.org/doc/html/rfc7230#section-3.2\n* https://github.com/advisories/GHSA-wxmh-65f7-jcvw","published":"2025-01-20T15:57:37.975Z","modified":"2026-10-28T02:30:57.197168438Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"codeigniter4/framework","fixedVersion":"4.5.8"}],"fix":{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6","label":"codeigniter4/CodeIgniter4@5f8aa24"},"references":[{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc7230#section-3.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24013.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wxmh-65f7-jcvw"},{"type":"ADVISORY","url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24013"},{"type":"FIX","url":"https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6"},{"type":"PACKAGE","url":"https://github.com/codeigniter4/CodeIgniter4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:57.197168438Z"}}