CVE-2024-29186

CVE-2024-29186 describes a denial-of-service vulnerability in Bref, an open-source project for serverless PHP on AWS, specifically affecting versions prior to 2.1.17. The vulnerability arises when Bref's Event-Driven Function runtime processes multipart requests with a RequestHandlerInterface, leading to slow multi-byte string operations during header parsing. An unauthenticated attacker can send specially crafted requests to increase the billed duration of Lambda functions, potentially leading to increased costs or service degradation. The CVSS score is 5.3 (Medium), indicating a low impact on availability. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.