Unrated severityNVD Advisory· Published Apr 29, 2024· Updated Nov 4, 2025
PHP function password_verify can erroneously return true when argument contains NUL
CVE-2024-3096
Description
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
Affected products
1Patches
3911950914263d94fdf582e1f9a9c7197c477Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.