TI-2024-16270 Aliases CVE-2024-24753 GHSA-99f9-gv72-fw9r

Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

MEDIUM 62CWE-436Published 2024-02-01 · Updated 2025-06-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00426 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed bref (brefphp): 2.1.13bref/bref (Packagist): 2.1.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
brefphp	bref	before 2.1.13	2.1.13	Patch available	CNA
—	bref/bref (Packagist)	before 2.1.13	2.1.13	Patch available	GHSA-99f9-gv72-fw9r

bref Vendorbrefphp Affected before 2.1.13 Fixed in 2.1.13 Patch available CNA
bref/bref (Packagist) Vendor— Affected before 2.1.13 Fixed in 2.1.13 Patch available GHSA-99f9-gv72-fw9r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mnapoli:bref::::::::	before 2.1.13	Vulnerable	brefphp

cpe:2.3:a:mnapoli:bref:*:*:*:*:*:*:*:* Versions before 2.1.13 Vulnerable ·brefphp

Remediation

Fix · CNA bref (brefphp) Fixed in 2.1.13
Fix · GHSA-99f9-gv72-fw9r bref/bref (Packagist) Fixed in 2.1.13 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-24753
2026-10-03 Alias added: GHSA-99f9-gv72-fw9r

References

Other 2

TI-2024-16271 Bref Body Parsing Inconsistency in Event-Driven Functions CVSS 3.1CRITICAL 9.8
TI-2024-16269 Bref Uploaded Files Not Deleted in Event-Driven Functions CVSS 3.1MEDIUM 6.5
TI-2024-19355 Slow String Operations via MultiPart Requests in Event-Driven Functions CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences