6.5Medium

CVE-2024-2756Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix

PHP Group PHP; php archive_tar Published: 2024-04-29 06:34 (2 years ago)

Description

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Weakness (CWE): CWE-20

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
php	archive_tar	—
PHP Group	PHP	8.1.* – < 8.1.28, 8.2.* – < 8.2.18, 8.3.* – < 8.3.5

References and patches

CVSS score

6.5Medium

Source: php · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS (chance of exploitation in 30 days)

38.12%

higher than 99% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: partial

Timeline

ID reserved2024-03-21
Published2024-04-29 06:34
Reached IP-DB2026-10-24 23:53
Last updated2025-11-04 20:18

Assigned by (CNA): php

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — PHP

9.2Critical

CVE-2026-109619 KEV 23 days ago

RCE via stale global state

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS

9.2Critical

CVE-2026-109618 KEV 23 days ago

RCE via OOM corruption

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS

5.9Medium

CVE-2026-92842 1 month ago

OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

PHP Group PHP

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup…

6.5Medium

CVE-2026-91768 1 month ago

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

PHP Group PHP

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with…

4.3Medium

CVE-2026-91769 1 month ago

TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP Group PHP

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certifi…

6.5Medium

CVE-2026-91767 1 month ago

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

PHP Group PHP

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious ser…