Vulnerability in Codeigniter
CVE-2025-24013
CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.
EPSS: 0.005 (39.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Codeigniter
- Codeigniter4 — versions < 4.5.8
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Not Applicable)
Frequently asked questions
- What is CVE-2025-24013?
- CVE-2025-24013 is a medium-severity vulnerability in Codeigniter, classified under CWE-436. CVSS score: 5.3/10. Published 2025-01-20.
- How severe is CVE-2025-24013?
- Medium severity. CVSS v3 base score is 5.3 out of 10.