CodeIgniter4 DoS Vulnerability

HIGH 7.5CVE-2024-29904 · GHSA-39fp-mqmm-gxj6 · Published 29/03/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
codeigniter4/framework Packagist	`< 4.4.7`	`4.4.7`
codeigniter codeigniter	`< 4.4.7`	`4.4.7`

Description

Impact

A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server.

Patches

Upgrade to v4.4.7 or later. See upgrading guide.

Workarounds

Disabling Auto Routing prevents a known attack vector in the framework.
Do not pass invalid values to the lang() function or Language class.

References

NVD description

CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later.

References

codeigniter4/CodeIgniter4 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-29904 · ADVISORY
codeigniter4/CodeIgniter4 commit fa851ac · WEB
codeigniter4/CodeIgniter4 · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free