{"id":"CVE-2024-29904","published":"2024-03-29T15:32:38Z","modified":"2024-08-21T22:44:16Z","title":"CodeIgniter4 Language class DoS Vulnerability","vendor":"codeigniter4","product":"CodeIgniter4","tier":"tail","description":{"text":"CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. \n","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00773,"percentile":0.55677,"provenance":"source"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"references":[{"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-39fp-mqmm-gxj6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0","tags":["x_refsource_MISC"]}],"priority":{"score":16.4,"factors":[{"name":"EPSS percentile","points":11.14},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"codeigniter4","affectedVersions":[{"vendor":"codeigniter4","product":"CodeIgniter4","versions":["< 4.4.7"]}],"affected":[{"ecosystem":"Packagist","package":"codeigniter4/framework","vulnerableRanges":["<4.4.7"],"patched":["4.4.7"],"from":["GHSA-39fp-mqmm-gxj6"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0802","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-codeigniter4-cve-2022-21715","parents":[{"from":"CVE-2022-21715","to":"CVE-2024-29904","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["system/CodeIgniter.php"],"commits":["https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd","https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0"],"basis":"rarely changed file"}]},{"from":"CVE-2022-24711","to":"CVE-2024-29904","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["system/CodeIgniter.php"],"commits":["https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781","https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-46170","published":"2022-12-22","fixed":"4.2.11","kev":false},{"cve":"CVE-2023-32692","published":"2023-05-30","fixed":"4.3.5","kev":false},{"cve":"CVE-2023-46240","published":"2023-10-31","fixed":"4.4.3","kev":false,"link":{"from":"CVE-2023-46240","to":"CVE-2024-29904","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:codeigniter4/framework","fromFixed":"4.4.3","toFixed":"4.4.7","daysApart":150}]}},{"cve":"CVE-2024-29904","published":"2024-03-29","fixed":"4.4.7","kev":false},{"cve":"CVE-2025-24013","published":"2025-01-20","fixed":"4.5.8","kev":false,"link":{"from":"CVE-2024-29904","to":"CVE-2025-24013","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:codeigniter4/framework","fromFixed":"4.4.7","toFixed":"4.5.8","daysApart":297}]}},{"cve":"CVE-2025-54418","published":"2025-07-28","fixed":"4.6.2","kev":false},{"cve":"CVE-2026-48062","published":"2026-07-17","fixed":"4.7.3","kev":false}],"package":"Packagist:codeigniter4/framework"}}