Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2024-3096 — MEDIUM severity vulnerability | Release Alert

CVE-2024-3096

6.5

MEDIUMCVSS v3

Published

April 29, 2024

Affected

8 projects

Assigned by

[email protected]

Severity scale

010

Description

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

GitHubThe PHP Interpreter

NVD

NPM

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD

NPMLezer-based PHP grammar

More on this CVE

NVD↗GitHub Advisory↗

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD

lezer-parser/php

GitHubPHP grammar for Lezer.

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD

Crates.ioRust bindings for the PHP runtime

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD

NPMAllows you to run PHP code in Node.js in various ways.

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD

Python Package IndexHandle some of the strange standards in PHP projects

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD

Docker HubWhile designed for web development, the PHP scripting language also provides general-purpose use.

>= 8.3.0, < 8.3.5, >= 8.1.0, < 8.1.28, >= 8.2.0, < 8.2.18NVD