CVE-2024-3096

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

Vulnerability in PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5. If a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() incorrectly returns true.

Risk Assessment

An attacker can log into an account whose password starts with a null byte using an empty password.

Recommendation

Update PHP to version 8.1.28, 8.2.18, 8.3.5 or later. Check that no passwords start with a null byte.

Original NVD description (English source)

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.