CVE-2024-29904: 
PHP vulnerability analysis and mitigation

A vulnerability was discovered in CodeIgniter, a PHP full-stack web framework, specifically affecting its Language class. The vulnerability (CVE-2024-29904) allows attackers to perform Denial of Service (DoS) attacks by consuming a large amount of memory on the server. This security issue was disclosed on March 29, 2024, and affects versions prior to 4.4.7 (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is related to CWE-835 (Loop with Unreachable Exit Condition - 'Infinite Loop'). The vulnerability specifically affects the Language class implementation and can be exploited remotely without requiring any privileges or user interaction (GitHub Advisory, NVD).

When exploited, this vulnerability allows attackers to consume a large amount of memory on the server, potentially leading to denial of service conditions. The attack affects the availability of the system while maintaining no impact on confidentiality or integrity (GitHub Advisory).

The vulnerability can be exploited remotely over the network with low attack complexity. No special privileges or user interaction is required to execute the attack, making it relatively straightforward to exploit (GitHub Advisory).

The primary mitigation is to upgrade to CodeIgniter version 4.4.7 or later. For those unable to upgrade immediately, two workarounds are available: disabling Auto Routing to prevent a known attack vector in the framework, and ensuring that no invalid values are passed to the lang() function or Language class (GitHub Advisory).