Improper Header Validation in CodeIgniter PHP Framework

CVE-2025-24013

What is CVE-2025-24013?

The CodeIgniter PHP framework has a vulnerability due to a lack of proper validation for headers in versions prior to 4.5.8. Attackers can exploit this weakness by sending deliberately malformed headers using the Header class, which can disrupt the application's functionality. This may result in application errors or the generation of invalid HTTP requests. In certain scenarios, this could lead to a Denial of Service (DoS) condition if a remote web application firewall perceives these malformed requests as a threat and blocks the application's communication. Users are advised to upgrade to version 4.5.8 or later to mitigate this issue.

References