CVE-2022-31629: Debian Linux

Medium severity, CVSS 6.5. EPSS: 49.3% chance of exploitation in the next 30 days.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• PHP PHP: before 7.4.31 (fixed in 7.4.31); from 8.0.0, before 8.0.24 (fixed in 8.0.24); from 8.1.0, before 8.1.11 (fixed in 8.1.11)

Published 2022-09-28. Last modified 2026-06-17.