CVE-2024-3096: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

Affected products

• Debian Debian Linux: version 10.0 only
• PHP PHP: from 8.1.0, before 8.1.28 (fixed in 8.1.28); from 8.2.0, before 8.2.18 (fixed in 8.2.18); from 8.3.0, before 8.3.5 (fixed in 8.3.5)

Published 2024-04-29. Last modified 2026-06-17.