Impact

A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server.

Patches

Upgrade to v4.4.7 or later. See upgrading guide.

Workarounds

• Disabling Auto Routing prevents a known attack vector in the framework.
• Do not pass invalid values to the lang() function or Language class.

References

• https://codeigniter4.github.io/userguide/outgoing/localization.html#language-localization
• https://codeigniter4.github.io/userguide/general/common_functions.html#lang