CVE-2024-3096

Published: Apr 29, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@php.net (Secondary)

Description

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

Affected (4)

Products: Php: Php · Debian: Debian Linux

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 8.1.0 to 8.1.28
Php Php	From 8.2.0 to 8.2.18
Php Php	From 8.3.0 to 8.3.5

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://www.openwall.com/lists/oss-security/2024/04/12/11

Source: security@php.net

Mailing List

https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr

Source: security@php.net

ExploitVendor Advisory

https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html

Source: security@php.net

Mailing List

https://security.netapp.com/advisory/ntap-20240510-0010/

Source: security@php.net

Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/04/12/11