6.5
Medium
CVE-2024-2756 Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site…
Description
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP 8.3 | earliest → < 8.3.5 | 8.3.5 |
| PHP 8.2 | earliest → < 8.2.18 | 8.2.18 |
| PHP 8.1 | earliest → < 8.1.28 | 8.1.28 |
| archive_tar | Versions not published |
References
- github.com github.com
- www.openwall.com www.openwall.com
- lists.debian.org lists.debian.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of PHP
The 103 CVEs of PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critical
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Medium
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Medium