Skip to content
Sign in
6.5 Medium

CVE-2022-31629 In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a…

Description

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Affected products and versions

Product Affected versions Fixed in
PHP 8.1 8.1.X → < 8.1.11 8.1.11
PHP 8.0 8.0.X → < 8.0.24 8.0.24
PHP 7.4 7.4.X → < 7.4.31 7.4.31

Other CVEs of PHP

The 103 CVEs of PHP →
CVE-2026-109619 RCE via stale global state 9.2 Critical CVE-2026-109618 RCE via OOM corruption 9.2 Critical CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a… 5.9 Medium CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so… 6.5 Medium
Track this CVE