# CVE-2024-24754: Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions

Source: https://junglewise.ai/threats/cve-2024-24754-bref-vulnerable-to-body-parsing-inconsistency-in-event-driven  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-01  
License: CC BY 4.0 with a link back

CVE-2024-24754 · Severity: low · CVSS 3.1 · Published 2024-02-01

Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions

Technologies: [bref/bref (Packagist)](https://junglewise.ai/threats/technologies/bref-bref). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2024-24754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-24754 being exploited in the wild.

**How severe is CVE-2024-24754?** Low severity, with a CVSS score of 3.1, published 1 February 2024.

**Which products and versions are affected?** bref/bref (Packagist) ECOSYSTEM:introduced=0,fixed=2.1.13.

**Is there a fix for CVE-2024-24754?** Yes. bref/bref (Packagist): upgrade to 2.1.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-24754?** Check whether you run bref/bref (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bref/bref (Packagist): upgrade to 2.1.13 or later

  ```sh
  composer require bref/bref:^2.1.13
  ```


## Affected products

- bref/bref (Packagist) ECOSYSTEM:introduced=0,fixed=2.1.13

## Identifiers

- CVE-2024-24754
- GHSA-82vx-mm6r-gg8w

## Related threats

- [Slow String Operations via MultiPart Requests in Event-Driven Functions](https://junglewise.ai/threats/cve-2024-29186-slow-string-operations-via-multipart-requests-in-event-driven)
- [Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2](https://junglewise.ai/threats/cve-2024-24753-bref-doesn-t-support-multiple-value-headers-in-apigatewayformatv2)
- [Bref's Uploaded Files Not Deleted in Event-Driven Functions](https://junglewise.ai/threats/cve-2024-24752-bref-s-uploaded-files-not-deleted-in-event-driven-functions)