CVE-2024-24753

CVE-2024-24753 concerns the Bref serverless PHP runtime on AWS Lambda. When used with API Gateway v2, Bref does not correctly handle multiple-value headers: if PHP emits two headers with the same name, only the last value is retained. This can undermine security policies that rely on multiple hea...

CVE-2024-29186

CVE-2024-29186 affects Bref prior to 2.1.17. During Event-Driven Function runtime handling with a RequestHandlerInterface, Bref converts Lambda events to PSR-7 objects and parses multipart headers. The Riverline/multipart-parser’s StreamedPart::parseHeaderContent performs slow multi-byte header s...

CVE-2024-24752

Bref CVE-2024-24752 affects AWS Lambda deployments using Bref with the Event-Driven Function runtime and a RequestHandlerInterface. During multipart handling, uploaded parts that are files are saved to /tmp with random names starting bref_upload_ and are not deleted after the request is processed...

CVE-2024-24754

Summary: The CVE concerns Bref running PHP on AWS Lambda with the Event-Driven Function runtime. When the Lambda event is converted to a PSR-7 request, multipart form data parts are parsed into nested arrays; specifically, keys ending with an open bracket (for example key0[key1][key2][) are treat...