Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y4qp-aw17-43eg
Vulnerability ID VCID-y4qp-aw17-43eg
Aliases CVE-2024-24754
GHSA-82vx-mm6r-gg8w
Summary Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the `$files` or `$parsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-436 Interpretation Conflict
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2024-24754
cvssv3.1_qr LOW https://github.com/advisories/GHSA-82vx-mm6r-gg8w
cvssv3.1 3.7 https://github.com/brefphp/bref
generic_textual LOW https://github.com/brefphp/bref
cvssv3.1 3.7 https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/Psr7Bridge.php#L130-L168
generic_textual LOW https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/Psr7Bridge.php#L130-L168
cvssv3.1 3.7 https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
generic_textual LOW https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
ssvc Track https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
cvssv3.1 3.7 https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
cvssv3.1_qr LOW https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
generic_textual LOW https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
ssvc Track https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
cvssv3.1 3.7 https://nvd.nist.gov/vuln/detail/CVE-2024-24754
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2024-24754
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-24754
https://github.com/brefphp/bref
https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/Psr7Bridge.php#L130-L168
c77d9f5abf021f29fa96b5720b7b84adbd199092 https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
CVE-2024-24754 https://nvd.nist.gov/vuln/detail/CVE-2024-24754
GHSA-82vx-mm6r-gg8w https://github.com/advisories/GHSA-82vx-mm6r-gg8w
GHSA-82vx-mm6r-gg8w https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/brefphp/bref
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/Psr7Bridge.php#L130-L168
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T15:38:19Z/ Found at https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T15:38:19Z/ Found at https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-24754
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.45589
EPSS Score 0.00227
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:47:35.051369+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/24xxx/CVE-2024-24754.json 38.6.0