CVE-2024-2756

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

Incomplete fix for CVE-2022-31629 in PHP. Network or same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Risk Assessment

An attacker can impersonate secure cookies, potentially leading to session theft or CSRF attacks.

Recommendation

Update PHP to the version with the complete fix. Implement additional cookie validation mechanisms.

Original NVD description (English source)

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.