Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.8 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

• CVE-2024-24753: 0.43% estimated exploitation activity in the next 30 days; percentile 36.91 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impacted Resources bref/src/Event/Http/HttpResponse.php:61-90 Description When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. Precisely, if PHP generates a response with two headers having the same key but different values only the latest one is kept. Impact If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple Content-Security-Policy headers, then Bref would just reflect the latest one. PoC 1. Create a new Bref project. 2. Create an index.php file with the following content: 3. Use the following serverless.yml to deploy the Lambda: 4. Browse the Lambda URL. 5. Notice that the JavaScript code is executed as the Content-Security-Policy: script-src 'none' header has been removed. 6. Notice that the external image has not been loaded as the Content-Security-Policy: img-src 'self' header has…

Published by the source

1 Feb 2024, 20:53 UTC

Last modified by the source

1 Feb 2024, 20:53 UTC

Source last checked

26 Oct 2026, 14:15 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-99f9-gv72-fw9r

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-24753

Advisory: Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2
IDs: CVE-2024-24753, GHSA-99f9-gv72-fw9r
Record: https://patchnext.com/advisories/cve-2024-24753 (revision 1, source checked 26 Oct 2026, 14:15 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: bref/bref 2.1.13. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist bref/bref: affected < 2.1.13; fixed in 2.1.13

## Suggested inspection (read-only)
- Packagist bref/bref: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on bref/bref.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-99f9-gv72-fw9r (GitHub-reviewed advisory GHSA-99f9-gv72-fw9r lists affected ranges: Packagist bref/bref >=0 <2.1.13)

Commands are suggestions: review each one before running it.