CVE-2024-29186

Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type` header of each part is read using the `Riverline/multipart-parser` library. The library, in the `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header value. Precisely, the `mb_convert_encoding` function is used with the first (`$string`) and third (`$from_encoding`) parameters read from the header value. An attacker could send specifically crafted requests which would force the server into performing long operations with a consequent long billed duration. The attack has the following requirements and limitations: The Lambda should use the Event-Driven Function runtime and the `RequestHandlerInterface` handler and should implement at least an endpoint accepting POST requests; the attacker can send requests up to 6MB long (this is enough to cause a billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref); and if the Lambda uses a PHP runtime <= php-82, the impact is higher as the billed duration in the default 1024MB RAM Lambda image of Bref could be brought to more than 900ms for each request. Notice that the vulnerability applies only to headers read from the request body as the request header has a limitation which allows a total maximum size of ~10KB. Version 2.1.17 contains a fix for this issue.

• CWE-400

• https://github.com/brefphp/bref/commit/5f7c0294628dbcec6305f638ff7e2dba8a1c2f45Patch
• https://github.com/brefphp/bref/security/advisories/GHSA-j4hq-f63x-f39rExploit, Release Notes
• https://github.com/brefphp/bref/commit/5f7c0294628dbcec6305f638ff7e2dba8a1c2f45Patch
• https://github.com/brefphp/bref/security/advisories/GHSA-j4hq-f63x-f39rExploit, Release Notes

Published

Mar 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29180Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-m…7.5
• CVE-2024-29181Strapi is an open-source content management system. Prior to…3.5
• CVE-2024-29182Collabora Online is a collaborative online office suite base…6.1
• CVE-2024-29183OpenRASP is a RASP solution that directly integrates its pro…6.1
• CVE-2024-29184FreeScout is a self-hosted help desk and shared mailbox. A S…8
• CVE-2024-29185FreeScout is a self-hosted help desk and shared mailbox. Ver…9
• CVE-2024-29187WiX toolset lets developers create installers for Windows In…7.3
• CVE-2024-29188WiX toolset lets developers create installers for Windows In…7.9
• CVE-2024-29189PyAnsys Geometry is a Python client library for the Ansys Ge…7.8
• CVE-2024-2919The Gutenberg Blocks by Kadence Blocks – Page Builder Featur…5.4
• CVE-2024-29190Mobile Security Framework (MobSF) is a pen-testing, malware …7.5
• CVE-2024-29191gotortc is a camera streaming application. Versions 1.8.5 an…6.1