In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzipUpgrade php-ldapUpgrade php-intlUpgrade php-pgsqlUpgrade apcu-panelUpgrade php-dbgUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-bcmathUpgrade php-jsonUpgrade php-commonUpgrade php-gmpUpgrade php-ffiUpgrade php-odbcUpgrade php-pecl-apcuUpgrade phpUpgrade php-mysqlndUpgrade php-enchantUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-snmpUpgrade php-cliUpgrade php-develUpgrade php-gdUpgrade php-pearUpgrade php-processUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug3Upgrade libzip-develUpgrade php-soapUpgrade php-dbaUpgrade php-mbstring | Dec 19, 2024 | Apr 29, 2024 |
| Alpine Linux | — | Upgrade php83Upgrade php82Upgrade php81 | Aug 22, 2024 | Apr 29, 2024 |
| Amazon Linux Ami 2 | — | Upgrade php-processUpgrade php-dbaUpgrade php-debuginfoUpgrade php-gmpUpgrade php-embeddedUpgrade php-mbstringUpgrade php-enchantUpgrade php-mysqlndUpgrade php-pspellUpgrade php-gdUpgrade php-opcacheUpgrade php-soapUpgrade php-cliUpgrade php-odbcUpgrade php-commonUpgrade php-snmpUpgrade php-develUpgrade phpUpgrade php-pdoUpgrade php-bcmathUpgrade php-sodiumUpgrade php-intlUpgrade php-dbgUpgrade php-fpmUpgrade php-ldapUpgrade php-xmlUpgrade php-pgsql | May 31, 2024 | Apr 29, 2024 |
| Amazon_linux_2023 | — | Upgrade php8.2-zip-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.1-tidyUpgrade php8.1-gdUpgrade php8.1-embedded-debuginfoUpgrade php8.1-dbaUpgrade php8.1-enchantUpgrade php8.2-bcmath-debuginfoUpgrade php8.2-cli-debuginfoUpgrade php8.1-snmpUpgrade php8.1-gmp-debuginfoUpgrade php8.2-enchant-debuginfoUpgrade php8.1-pspell-debuginfoUpgrade php8.2-dbgUpgrade php8.2-commonUpgrade php8.1-process-debuginfoUpgrade php8.1-gd-debuginfoUpgrade php8.1-debugsourceUpgrade php8.1-embeddedUpgrade php8.2-fpmUpgrade php8.2-odbcUpgrade php8.1-zip-debuginfoUpgrade php8.2-ldapUpgrade php8.2-xmlUpgrade php8.2-sodiumUpgrade php8.2-mysqlndUpgrade php8.1-mysqlndUpgrade php8.1-intl-debuginfoUpgrade php8.1-ffi-debuginfoUpgrade php8.1-xml-debuginfoUpgrade php8.1-cli-debuginfoUpgrade php8.1-odbcUpgrade php8.2-soapUpgrade php8.2-gdUpgrade php8.2-ffiUpgrade php8.1-debuginfoUpgrade php8.1-pspellUpgrade php8.2-develUpgrade php8.2-ldap-debuginfoUpgrade php8.2-bcmathUpgrade php8.1-fpmUpgrade php8.2-tidy-debuginfoUpgrade php8.1-ffiUpgrade php8.2-zipUpgrade php8.1-common-debuginfoUpgrade php8.1-fpm-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.1-commonUpgrade php8.2-intlUpgrade php8.2Upgrade php8.1-bcmathUpgrade php8.2-common-debuginfoUpgrade php8.1-tidy-debuginfoUpgrade php8.1-dba-debuginfoUpgrade php8.1-intlUpgrade php8.1-dbg-debuginfoUpgrade php8.2-dba-debuginfoUpgrade php8.2-intl-debuginfoUpgrade php8.1-snmp-debuginfoUpgrade php8.1-pgsql-debuginfoUpgrade php8.1-opcache-debuginfoUpgrade php8.1-mysqlnd-debuginfoUpgrade php8.1-mbstring-debuginfoUpgrade php8.1-enchant-debuginfoUpgrade php8.2-opcache-debuginfoUpgrade php8.2-mbstring-debuginfoUpgrade php8.1-soapUpgrade php8.2-processUpgrade php8.1-develUpgrade php8.2-embedded-debuginfoUpgrade php8.2-debugsourceUpgrade php8.1-xmlUpgrade php8.1-dbgUpgrade php8.1-cliUpgrade php8.1-bcmath-debuginfoUpgrade php8.1Upgrade php8.2-mysqlnd-debuginfoUpgrade php8.1-odbc-debuginfo | Feb 17, 2025 | Apr 12, 2024 |
| Debian | — | Upgrade php8.2Upgrade php7.4 | Apr 17, 2024 | Apr 17, 2024 |
| Freebsd | — | Upgrade php82Upgrade php81Upgrade php83 | Dec 10, 2025 | Apr 16, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Aug 13, 2024 | Apr 29, 2024 |
| Oracle_linux | — | Upgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-dbgUpgrade php-pgsqlUpgrade php-commonUpgrade php-intlUpgrade php-ffiUpgrade php-jsonUpgrade php-ldapUpgrade libzip-toolsUpgrade php-pecl-zipUpgrade php-soapUpgrade php-pecl-apcuUpgrade php-odbcUpgrade php-pdoUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-enchantUpgrade php-embeddedUpgrade phpUpgrade php-snmpUpgrade php-pecl-xdebug3Upgrade php-develUpgrade php-xmlrpcUpgrade php-xmlUpgrade libzip-develUpgrade php-cliUpgrade libzipUpgrade php-processUpgrade php-pearUpgrade php-fpmUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade php-bcmathUpgrade php-gd | Dec 12, 2024 | Apr 12, 2024 |
| Php | — | Upgrade to PHP version 8.1.28Upgrade to PHP version 8.2.18Upgrade to PHP version 8.3.5 | Feb 17, 2026 | Feb 17, 2026 |
| Redhat_linux | — | Upgrade php-dba-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-dbg-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-xdebug3Upgrade php-mysqlnd-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-rrdUpgrade libzip-debugsourceUpgrade php-debuginfoUpgrade php-processUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-xdebugUpgrade php-opcache-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade libzip-toolsUpgrade php-pearUpgrade php-snmp-debuginfoUpgrade php-dbaUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-xmlUpgrade php-mbstringUpgrade php-commonUpgrade php-common-debuginfoUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-bcmathUpgrade php-fpm-debuginfoUpgrade php-jsonUpgrade php-bcmath-debuginfoUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php-develUpgrade php-pecl-zip-debuginfoUpgrade php-debugsourceUpgrade php-pecl-zipUpgrade php-ldapUpgrade php-pecl-rrd-debugsourceUpgrade php-gdUpgrade apcu-panelUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-cliUpgrade php-pecl-apcu-develUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-mysqlndUpgrade php-ffi-debuginfoUpgrade phpUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-gmp-debuginfoNo solution existsUpgrade php-gd-debuginfoUpgrade php-cli-debuginfoUpgrade php-embeddedUpgrade php-enchantUpgrade php-json-debuginfoUpgrade php-gmpUpgrade libzip-develUpgrade php-pecl-xdebug3-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzipUpgrade php-pecl-xdebug-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pdoUpgrade php-ffiUpgrade php-dbgUpgrade php-odbcUpgrade php-process-debuginfo | Feb 10, 2025 | Apr 29, 2024 |
| Rocky_linux | — | Upgrade php-enchant-debuginfoUpgrade php-bcmathUpgrade php-gmpUpgrade php-pecl-xdebug-debuginfoUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-dbgUpgrade php-pgsqlUpgrade php-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-mbstringUpgrade libzipUpgrade php-pecl-xdebug3-debuginfoUpgrade php-gdUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-pecl-xdebug3Upgrade php-embeddedUpgrade libzip-debuginfoUpgrade php-dba-debuginfoUpgrade php-cli-debuginfoUpgrade php-ldapUpgrade php-develUpgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-develUpgrade php-soapUpgrade php-enchantUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebugUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-dbg-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-pdoUpgrade php-xml-debuginfoUpgrade php-jsonUpgrade php-xmlrpcUpgrade libzip-tools-debuginfoUpgrade php-intl-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debugsourceUpgrade php-fpm-debuginfoUpgrade php-cliUpgrade php-bcmath-debuginfoUpgrade php-ffiUpgrade php-mysqlndUpgrade php-snmpUpgrade php-processUpgrade php-mbstring-debuginfoUpgrade phpUpgrade php-snmp-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-opcache-debuginfoUpgrade php-opcacheUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade libzip-develUpgrade php-pecl-rrdUpgrade php-commonUpgrade libzip-toolsUpgrade php-soap-debuginfoUpgrade php-gmp-debuginfoUpgrade php-dbaUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-intl | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade php7-enchantUpgrade php74-ftpUpgrade php8-pgsqlUpgrade php81-fastcgiUpgrade php81-pharUpgrade php74Upgrade php74-pgsqlUpgrade php7-exifUpgrade php8-xmlwriterUpgrade php8-pharUpgrade php81-develUpgrade php74-intlUpgrade php81Upgrade php7-pcntlUpgrade php81-xslUpgrade php81-intlUpgrade php81-fpm-apacheUpgrade php7-dbaUpgrade php74-sysvmsgUpgrade php74-opcacheUpgrade php81-mbstringUpgrade php7-embedUpgrade php74-exifUpgrade php81-curlUpgrade php81-embedUpgrade php8-tidyUpgrade php74-bz2Upgrade php74-zipUpgrade php81-zlibUpgrade php8-mbstringUpgrade php74-calendarUpgrade php81-gmpUpgrade php8-sysvsemUpgrade php74-domUpgrade php74-xslUpgrade php7-xmlrpcUpgrade php7-intlUpgrade php8-mysqlUpgrade php74-pharUpgrade php74-xmlrpcUpgrade php8-fileinfoUpgrade php81-pgsqlUpgrade php81-bcmathUpgrade php8-zlibUpgrade php81-gdUpgrade php81-exifUpgrade php8-tokenizerUpgrade php74-fastcgiUpgrade php8-develUpgrade php74-xmlwriterUpgrade php74-mysqlUpgrade php74-zlibUpgrade php7-fileinfoUpgrade php7-ftpUpgrade php7-snmpUpgrade php81-dbaUpgrade php7-sysvmsgUpgrade php74-develUpgrade php7-fpmUpgrade php7-mbstringUpgrade php74-jsonUpgrade php74-readlineUpgrade php74-gmpUpgrade php7-gmpUpgrade php7-opensslUpgrade php74-sysvsemUpgrade php7-xmlreaderUpgrade php7-tidyUpgrade php8-ftpUpgrade php81-sysvshmUpgrade php8-dbaUpgrade apache2-mod_php74Upgrade php81-snmpUpgrade php81-socketsUpgrade php7-jsonUpgrade php74-dbaUpgrade php7-gdUpgrade php7-tokenizerUpgrade php7-pharUpgrade php74-fileinfoUpgrade php81-xmlwriterUpgrade php74-snmpUpgrade php74-sysvshmUpgrade php74-ldapUpgrade php81-sysvmsgUpgrade php7-soapUpgrade php81-fpmUpgrade php7-xmlwriterUpgrade php8-snmpUpgrade php8-sqliteUpgrade php81-fileinfoUpgrade php81-testUpgrade php8-xmlreaderUpgrade php74-opensslUpgrade php8-iconvUpgrade php8-odbcUpgrade php8-xslUpgrade php81-mysqlUpgrade php74-xmlreaderUpgrade php8-exifUpgrade php7-xslUpgrade php8-opensslUpgrade php7-ctypeUpgrade php7-pgsqlUpgrade php74-ctypeUpgrade php8-pcntlUpgrade php81-calendarUpgrade php81-opensslUpgrade php8-soapUpgrade php81-sodiumUpgrade php7-domUpgrade php8-posixUpgrade php81-sqliteUpgrade php74-fpmUpgrade apache2-mod_php7Upgrade apache2-mod_php81Upgrade php7Upgrade php7-curlUpgrade php74-enchantUpgrade php8-gmpUpgrade php7-zlibUpgrade php8-shmopUpgrade php7-sqliteUpgrade php81-pcntlUpgrade php81-domUpgrade apache2-mod_php8Upgrade php8-ctypeUpgrade php74-socketsUpgrade php8-calendarUpgrade php8-domUpgrade php81-ldapUpgrade php81-tokenizerUpgrade php8-sysvshmUpgrade php8-zipUpgrade php74-tidyUpgrade php74-sodiumUpgrade php74-iconvUpgrade php7-zipUpgrade php7-bz2Upgrade php81-shmopUpgrade php7-fastcgiUpgrade php7-develUpgrade php81-gettextUpgrade php81-cliUpgrade php8-testUpgrade php74-odbcUpgrade php74-bcmathUpgrade php7-sodiumUpgrade php7-iconvUpgrade php74-sqliteUpgrade php7-socketsUpgrade php81-soapUpgrade php7-ldapUpgrade php7-gettextUpgrade php8-sysvmsgUpgrade php81-xmlreaderUpgrade php8-curlUpgrade php74-tokenizerUpgrade php8-bz2Upgrade php8-fastcgiUpgrade php81-ctypeUpgrade php81-pdoUpgrade php81-ffiUpgrade php8-pdoUpgrade php81-ftpUpgrade php8-opcacheUpgrade php8-ldapUpgrade php8-fpmUpgrade php8-embedUpgrade php74-gettextUpgrade php7-cliUpgrade php8-gettextUpgrade php7-calendarUpgrade php81-zipUpgrade php81-sysvsemUpgrade php8-enchantUpgrade php8-cliUpgrade php74-posixUpgrade php7-shmopUpgrade php7-posixUpgrade php7-opcacheUpgrade php81-readlineUpgrade php81-opcacheUpgrade php8-sodiumUpgrade php8-ffiUpgrade php8-bcmathUpgrade php8Upgrade php74-pdoUpgrade php74-mbstringUpgrade php74-gdUpgrade php7-mysqlUpgrade php81-tidyUpgrade php7-sysvsemUpgrade php8-fpm-apacheUpgrade php81-posixUpgrade php81-enchantUpgrade php8-intlUpgrade php74-soapUpgrade php74-pcntlUpgrade php8-gdUpgrade php81-odbcUpgrade php8-readlineUpgrade php8-socketsUpgrade php7-sysvshmUpgrade php74-shmopUpgrade php7-testUpgrade php7-odbcUpgrade php81-bz2Upgrade php81-iconvUpgrade php7-bcmathUpgrade php7-pdoUpgrade php7-readlineUpgrade php74-curl | Apr 29, 2024 | Apr 26, 2024 |
| Ubuntu | — | Upgrade php7.0 (Ubuntu Pro)Upgrade libapache2-mod-php7.4Upgrade php7.0-fpm (Ubuntu Pro)Upgrade libapache2-mod-php8.2Upgrade php7.2-fpm (Ubuntu Pro)Upgrade php7.0-cgi (Ubuntu Pro)Upgrade php8.1Upgrade php7.4-fpmUpgrade php7.2-cgi (Ubuntu Pro)Upgrade php8.1-cgiUpgrade php8.2-fpmUpgrade php7.4Upgrade php7.4-cliUpgrade php8.2-cliUpgrade php7.0-xml (Ubuntu Pro)Upgrade php7.2-cli (Ubuntu Pro)Upgrade php8.1-fpmUpgrade libapache2-mod-php7.2 (Ubuntu Pro)Upgrade php7.4-cgiUpgrade php8.1-xmlUpgrade php8.2-xmlUpgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade php7.2 (Ubuntu Pro)Upgrade php8.2-cgiUpgrade libapache2-mod-php8.1Upgrade php8.2Upgrade php7.0-cli (Ubuntu Pro)Upgrade php7.2-xml (Ubuntu Pro)Upgrade php8.1-cliUpgrade php7.4-xml | Apr 30, 2024 | Apr 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub