CVE-2025-24013 json
CodeIgniter validation of header name and value
published last yr. modified 4mo ago also EUVD-2025-0207 , GHSA-x5mq-jjr3-vmx6
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.
Patch / fix
- packagist codeigniter4/framework 4.5.8
- codeigniter codeigniter 4.5.8
Is CVE-2025-24013 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | codeigniter4/framework | <4.5.8 |
4.5.8 |
Affected products
- codeigniter4 CodeIgniter4
Classification
- Weakness
-
- CWE-436 Interpretation Conflict
References
-
github.com
/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6
web, patch
-
github.com
/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6
web, vendor-advisory
-
datatracker.ietf.org
/doc/html/rfc7230#section-3.2
web, technical-description
-
github.com
/advisories/GHSA-wxmh-65f7-jcvw
advisory, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2025-24013
advisory
-
github.com
/codeigniter4/CodeIgniter4
package
Sources
- CVE List CVE-2025-24013
- GitHub Advisory GHSA-x5mq-jjr3-vmx6
- NVD CVE-2025-24013
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.