In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pdoUpgrade php-pgsqlUpgrade phpUpgrade php-ffiUpgrade php-gmpUpgrade php-ldapUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-intlUpgrade libzipUpgrade apcu-panelUpgrade php-dbgUpgrade php-jsonUpgrade php-bcmathUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-gdUpgrade php-pearUpgrade php-soapUpgrade php-pecl-xdebugUpgrade php-mysqlndUpgrade php-pecl-xdebug3Upgrade libzip-develUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-develUpgrade php-enchantUpgrade php-snmpUpgrade php-cliUpgrade php-fpmUpgrade php-processUpgrade php-opcacheUpgrade php-xmlUpgrade php-dbaUpgrade php-pecl-zipUpgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-embedded | Dec 19, 2024 | Apr 29, 2024 |
| Alpine Linux | — | Upgrade php81Upgrade php82Upgrade php83 | Aug 22, 2024 | Apr 29, 2024 |
| Amazon Linux Ami 2 | — | Upgrade php-cliUpgrade php-pgsqlUpgrade php-xmlUpgrade php-commonUpgrade php-dbgUpgrade php-ldapUpgrade php-fpmUpgrade php-pdoUpgrade php-bcmathUpgrade phpUpgrade php-develUpgrade php-odbcUpgrade php-snmpUpgrade php-intlUpgrade php-sodiumUpgrade php-dbaUpgrade php-debuginfoUpgrade php-processUpgrade php-pspellUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-gdUpgrade php-gmpUpgrade php-soapUpgrade php-opcacheUpgrade php-enchantUpgrade php-mbstring | May 31, 2024 | Apr 29, 2024 |
| Amazon_linux_2023 | — | Upgrade php8.2-mbstring-debuginfoUpgrade php8.2-dba-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.2-opcache-debuginfoUpgrade php8.1-process-debuginfoUpgrade php8.1-snmp-debuginfoUpgrade php8.1-debugsourceUpgrade php8.1-mysqlnd-debuginfoUpgrade php8.2-common-debuginfoUpgrade php8.1-soapUpgrade php8.2-processUpgrade php8.1-dbg-debuginfoUpgrade php8.2Upgrade php8.1-dba-debuginfoUpgrade php8.1-intlUpgrade php8.2-dbgUpgrade php8.1-zip-debuginfoUpgrade php8.1-bcmathUpgrade php8.1-tidy-debuginfoUpgrade php8.1-gd-debuginfoUpgrade php8.2-commonUpgrade php8.2-fpmUpgrade php8.2-enchant-debuginfoUpgrade php8.1-pspell-debuginfoUpgrade php8.1-embeddedUpgrade php8.1-develUpgrade php8.1-xml-debuginfoUpgrade php8.2-ffiUpgrade php8.1-odbcUpgrade php8.1-cli-debuginfoUpgrade php8.1-dbgUpgrade php8.2-embedded-debuginfoUpgrade php8.2-soapUpgrade php8.2-gdUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.1-xmlUpgrade php8.1Upgrade php8.2-debugsourceUpgrade php8.1-bcmath-debuginfoUpgrade php8.2-intlUpgrade php8.2-odbcUpgrade php8.1-enchant-debuginfoUpgrade php8.1-mbstring-debuginfoUpgrade php8.2-sodiumUpgrade php8.2-xmlUpgrade php8.2-intl-debuginfoUpgrade php8.1-mysqlndUpgrade php8.1-fpm-debuginfoUpgrade php8.2-ldapUpgrade php8.1-commonUpgrade php8.2-mysqlndUpgrade php8.1-embedded-debuginfoUpgrade php8.1-gdUpgrade php8.1-dbaUpgrade php8.1-snmpUpgrade php8.1-debuginfoUpgrade php8.1-enchantUpgrade php8.1-intl-debuginfoUpgrade php8.1-tidyUpgrade php8.1-gmp-debuginfoUpgrade php8.1-ffi-debuginfoUpgrade php8.1-cliUpgrade php8.2-bcmath-debuginfoUpgrade php8.1-odbc-debuginfoUpgrade php8.1-opcache-debuginfoUpgrade php8.2-cli-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.1-pgsql-debuginfoUpgrade php8.2-zip-debuginfoUpgrade php8.1-pgsqlUpgrade php8.2-ldap-debuginfoUpgrade php8.1-pdoUpgrade php8.1-fpmUpgrade php8.1-ffiUpgrade php8.2-bcmathUpgrade php8.1-mbstringUpgrade php8.2-pspell-debuginfoUpgrade php8.2-enchantUpgrade php8.2-debuginfoUpgrade php8.1-processUpgrade php8.2-tidyUpgrade php8.2-pgsqlUpgrade php8.2-pdo-debuginfoUpgrade php8.2-gmp-debuginfoUpgrade php8.1-opcacheUpgrade php8.2-odbc-debuginfoUpgrade php8.2-gd-debuginfoUpgrade php8.2-dbaUpgrade php8.2-sodium-debuginfoUpgrade php8.2-develUpgrade php8.2-embeddedUpgrade php8.2-fpm-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.2-gmpUpgrade php8.2-xml-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.2-pdoUpgrade php8.2-mbstringUpgrade php8.2-snmpUpgrade php8.2-soap-debuginfoUpgrade php8.2-cliUpgrade php8.1-soap-debuginfoUpgrade php8.1-ldapUpgrade php8.2-pspellUpgrade php8.1-pspellUpgrade php8.1-zipUpgrade php8.1-pdo-debuginfoUpgrade php8.1-gmpUpgrade php8.2-snmp-debuginfoUpgrade php8.1-ldap-debuginfoUpgrade php8.1-common-debuginfoUpgrade php8.2-zipUpgrade php8.2-tidy-debuginfoUpgrade php8.2-opcache | Feb 17, 2025 | Apr 12, 2024 |
| Debian | — | Upgrade php8.2Upgrade php7.4 | Apr 17, 2024 | Apr 17, 2024 |
| Freebsd | — | Upgrade php82Upgrade php83Upgrade php81 | Dec 10, 2025 | Apr 16, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Aug 13, 2024 | Apr 29, 2024 |
| Oracle_linux | — | Upgrade phpUpgrade libzip-develUpgrade php-develUpgrade php-snmpUpgrade php-embeddedUpgrade php-fpmUpgrade php-pecl-xdebug3Upgrade libzipUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-pearUpgrade php-processUpgrade php-gdUpgrade php-pecl-xdebugUpgrade php-enchantUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade php-cliUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-mbstringUpgrade php-intlUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-pdoUpgrade php-ldapUpgrade php-jsonUpgrade php-ffiUpgrade apcu-panelUpgrade php-dbgUpgrade php-soapUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-odbcUpgrade php-commonUpgrade php-dbaUpgrade php-pgsql | Dec 12, 2024 | Apr 12, 2024 |
| Php | — | Upgrade to PHP version 8.1.28Upgrade to PHP version 8.2.18Upgrade to PHP version 8.3.5 | Feb 17, 2026 | Feb 17, 2026 |
| Redhat_linux | — | Upgrade php-pdoUpgrade php-soapUpgrade php-dbgNo solution existsUpgrade libzipUpgrade php-cliUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade php-enchantUpgrade php-xmlrpc-debuginfoUpgrade php-fpmUpgrade php-process-debuginfoUpgrade php-mysqlndUpgrade php-pecl-xdebug-debuginfoUpgrade php-develUpgrade php-gmp-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-json-debuginfoUpgrade php-cli-debuginfoUpgrade php-gmpUpgrade libzip-develUpgrade php-odbcUpgrade php-debugsourceUpgrade php-gdUpgrade php-pecl-xdebug3-debuginfoUpgrade phpUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-pecl-apcu-develUpgrade php-ffiUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-embeddedUpgrade php-fpm-debuginfoUpgrade libzip-debuginfoUpgrade php-opcacheUpgrade php-mbstring-debuginfoUpgrade apcu-panelUpgrade php-jsonUpgrade php-pecl-zipUpgrade libzip-tools-debuginfoUpgrade php-bcmathUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pgsqlUpgrade php-commonUpgrade php-dba-debuginfoUpgrade php-snmp-debuginfoUpgrade php-common-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-soap-debuginfoUpgrade php-pearUpgrade libzip-toolsUpgrade php-dbg-debuginfoUpgrade php-intl-debuginfoUpgrade php-xml-debuginfoUpgrade php-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-debuginfoUpgrade php-opcache-debuginfoUpgrade php-processUpgrade libzip-debugsourceUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debuginfoUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-pecl-zip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-mbstringUpgrade php-xml | Feb 10, 2025 | Apr 29, 2024 |
| Rocky_linux | — | Upgrade php-common-debuginfoUpgrade phpUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcache-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-opcacheUpgrade php-snmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-process-debuginfoUpgrade php-soap-debuginfoUpgrade libzip-develUpgrade php-mysqlndUpgrade php-pecl-rrdUpgrade php-commonUpgrade php-ffiUpgrade php-intl-debuginfoUpgrade php-debuginfoUpgrade libzip-debugsourceUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade php-dbaUpgrade php-gmp-debuginfoUpgrade php-snmpUpgrade php-xmlUpgrade php-intlUpgrade php-processUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pdo-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade php-pdoUpgrade php-ffi-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xmlrpcUpgrade php-mysqlnd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-xml-debuginfoUpgrade php-soapUpgrade php-pecl-xdebug3-debuginfoUpgrade php-dbgUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-fpmUpgrade php-pecl-apcu-debuginfoUpgrade php-odbc-debuginfoUpgrade libzipUpgrade php-pecl-apcu-develUpgrade php-json-debuginfoUpgrade php-enchantUpgrade php-embeddedUpgrade php-odbcUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug3Upgrade php-pecl-apcuUpgrade php-debugsourceUpgrade php-ldapUpgrade php-gdUpgrade php-cli-debuginfoUpgrade php-pecl-zipUpgrade php-mbstringUpgrade libzip-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-xdebug | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade php8-ftpUpgrade php81-socketsUpgrade php7-opensslUpgrade php7-xmlreaderUpgrade php74-jsonUpgrade php74-readlineUpgrade php8-dbaUpgrade php74-sysvsemUpgrade php74Upgrade php74-pgsqlUpgrade php8-mbstringUpgrade php74-calendarUpgrade php74-bz2Upgrade php74-opcacheUpgrade php81-curlUpgrade php81-sysvshmUpgrade php7-xmlrpcUpgrade php7-dbaUpgrade php81-zlibUpgrade php81-xmlwriterUpgrade php7-enchantUpgrade php74-zipUpgrade php74-xslUpgrade php74-gmpUpgrade php8-tidyUpgrade php8-mysqlUpgrade php81-embedUpgrade apache2-mod_php74Upgrade php7-jsonUpgrade php81-dbaUpgrade php81-develUpgrade php74-dbaUpgrade php81-exifUpgrade php8-xmlwriterUpgrade php74-domUpgrade php81-fpm-apacheUpgrade php81-gmpUpgrade php81-gdUpgrade php74-intlUpgrade php74-exifUpgrade php74-pharUpgrade php74-fileinfoUpgrade php74-sysvshmUpgrade php7-tokenizerUpgrade php8-pgsqlUpgrade php7-gdUpgrade php7-pharUpgrade php7-soapUpgrade php8-sysvsemUpgrade apache2-mod_php81Upgrade php7Upgrade apache2-mod_php7Upgrade php7-curlUpgrade php8-xmlreaderUpgrade php81-snmpUpgrade php7-domUpgrade php81Upgrade php7-embedUpgrade php74-ldapUpgrade php74-sysvmsgUpgrade php74-opensslUpgrade php81-sysvmsgUpgrade php74-ftpUpgrade php74-snmpUpgrade php8-iconvUpgrade php8-xslUpgrade php81-mbstringUpgrade php81-pharUpgrade php8-odbcUpgrade php81-fastcgiUpgrade php74-xmlrpcUpgrade php8-fileinfoUpgrade php7-fileinfoUpgrade php8-snmpUpgrade php7-xmlwriterUpgrade php7-exifUpgrade php81-testUpgrade php7-fpmUpgrade php7-mbstringUpgrade php7-pcntlUpgrade php8-sqliteUpgrade php74-mysqlUpgrade php74-xmlwriterUpgrade php81-fileinfoUpgrade php81-sqliteUpgrade php7-ctypeUpgrade php81-sodiumUpgrade php7-pgsqlUpgrade php8-soapUpgrade php81-calendarUpgrade php81-opensslUpgrade php74-develUpgrade php8-exifUpgrade php8-opensslUpgrade php74-xmlreaderUpgrade php8-pcntlUpgrade php74-ctypeUpgrade php8-posixUpgrade php81-fpmUpgrade php74-zlibUpgrade php7-sysvmsgUpgrade php74-fpmUpgrade php81-bcmathUpgrade php7-gmpUpgrade php7-snmpUpgrade php74-fastcgiUpgrade php8-zlibUpgrade php8-develUpgrade php8-pharUpgrade php7-intlUpgrade php8-tokenizerUpgrade php81-pgsqlUpgrade php81-xslUpgrade php7-ftpUpgrade php7-tidyUpgrade php81-mysqlUpgrade php7-xslUpgrade php81-intlUpgrade php81-sysvsemUpgrade php8-cliUpgrade php7-calendarUpgrade php81-gettextUpgrade php8-embedUpgrade php74-shmopUpgrade php81-odbcUpgrade php74-posixUpgrade php81-zipUpgrade php7-socketsUpgrade php7-cliUpgrade php8-gettextUpgrade php8-enchantUpgrade php81-tidyUpgrade php74-pdoUpgrade php8Upgrade php8-ffiUpgrade php8-bcmathUpgrade php74-mbstringUpgrade php74-gdUpgrade php7-shmopUpgrade php7-posixUpgrade php7-opcacheUpgrade php7-mysqlUpgrade php81-readlineUpgrade php81-opcacheUpgrade php81-iconvUpgrade php8-sodiumUpgrade php8-gmpUpgrade php81-soapUpgrade php8-fastcgiUpgrade php8-bz2Upgrade php74-soapUpgrade php81-enchantUpgrade php8-intlUpgrade php8-fpm-apacheUpgrade php74-pcntlUpgrade php7-sysvsemUpgrade php81-posixUpgrade php74-gettextUpgrade php7-pdoUpgrade php8-calendarUpgrade php7-iconvUpgrade php81-ctypeUpgrade php81-shmopUpgrade php7-sodiumUpgrade php8-curlUpgrade php7-ldapUpgrade php81-xmlreaderUpgrade php81-ftpUpgrade php81-ffiUpgrade php8-socketsUpgrade php7-sysvshmUpgrade php7-gettextUpgrade php8-pdoUpgrade php74-tokenizerUpgrade php74-bcmathUpgrade php81-bz2Upgrade php8-ldapUpgrade php8-sysvmsgUpgrade php74-tidyUpgrade php74-sodiumUpgrade php7-zipUpgrade php7-bz2Upgrade php81-pcntlUpgrade php81-domUpgrade php8-shmopUpgrade php8-ctypeUpgrade php74-socketsUpgrade php74-enchantUpgrade php7-zlibUpgrade php7-sqliteUpgrade apache2-mod_php8Upgrade php81-tokenizerUpgrade php8-zipUpgrade php74-sqliteUpgrade php74-iconvUpgrade php8-sysvshmUpgrade php8-readlineUpgrade php8-gdUpgrade php8-testUpgrade php81-cliUpgrade php74-odbcUpgrade php7-fastcgiUpgrade php8-domUpgrade php7-testUpgrade php7-odbcUpgrade php81-pdoUpgrade php8-opcacheUpgrade php7-bcmathUpgrade php7-develUpgrade php81-ldapUpgrade php74-curlUpgrade php7-readlineUpgrade php8-fpm | Apr 29, 2024 | Apr 26, 2024 |
| Ubuntu | — | Upgrade php8.1-cliUpgrade php7.0-xml (Ubuntu Pro)Upgrade libapache2-mod-php7.2 (Ubuntu Pro)Upgrade php7.0-cli (Ubuntu Pro)Upgrade php7.4-xmlUpgrade php8.2-cliUpgrade php7.4-cgiUpgrade php7.2-xml (Ubuntu Pro)Upgrade php8.2-xmlUpgrade php7.2-cli (Ubuntu Pro)Upgrade php8.1-fpmUpgrade php8.1-xmlUpgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade php7.2 (Ubuntu Pro)Upgrade php8.2-cgiUpgrade libapache2-mod-php8.1Upgrade php8.2Upgrade libapache2-mod-php7.4Upgrade php7.4-cliUpgrade php7.4-fpmUpgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.2-cgi (Ubuntu Pro)Upgrade php7.0-cgi (Ubuntu Pro)Upgrade libapache2-mod-php8.2Upgrade php7.4Upgrade php8.1-cgiUpgrade php8.2-fpmUpgrade php8.1Upgrade php7.0 (Ubuntu Pro)Upgrade php7.2-fpm (Ubuntu Pro) | Apr 30, 2024 | Apr 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub